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ABSTHACIi  The  complexity  cf  modern  ordnance  cakes  difficult 
the  assessment  of  the  overall  effect  on  user  safety  of  Indi¬ 
vidual  design,  manufacture,  handling  procedure  or  use  factors. 
An  orderly  process  tor  the  study  of  the  relative  sarety  cf 
alternate  designs  and/or  practices  Is  presented,  with  an 
example  of  Its  use  In  analyzing  a  coupler  electro- mechanical 
bomb  fuze  system. 

This  analysis  process  consists  oft 

1.  Organizing  accident-inducing  happenstances  Into  diagrams 
Indicating  possible  combinations  resulting  in  accident. 

2.  Assigning  best  estimates  cf  probability  to  the  individual 
happenstances  and  cress-shacking  for  cons latency. 

3.  Combining  the  resulting  accident  possibilities  by  appro¬ 
priate  cathecatlcal  processes. 

4.  Weighing  tne  relative  frequency  of  exposure  to  the  vari¬ 
ous  hazard  routes  and  the  relative  consequen-es  of  accident 
at  corresponding  times  and  places  in  determining  an  overall 
accident  probability  Index. 

5.  Determining  froa  study  cf  these  results  the  relative 
safety  of  designs,  effect*  of  Individual  probabilities  r~ 
overall  safety,  points  of  especial  haze."d,  areas  for  test- 
etc.  as  a  basis  for  administrative  declilens. 
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Tht  opinions  stated  herein  are  those  of  the  tscnriic&l 
evaluation  hepartaent  and  do  not  constitute  a  recessendaticn 
by  the  laboratory  for  the  use  of  this  systea  cf  analysis. 

The  process  described  has  been  found  useful  In  the  bepartnent 
as  an  aid  <n  reaching  sound  technical  conclusions  leadlnc  to 
administrative  decisions  and  Is  presented  lr.  tte  interest  of 
a  acre  widespread  appreciation  for  problems  Involves  In 
achieving  optima  ordnance  designs. 

It  13  recognized  that  the  choice  of  aethod  node  herein 
Is  frequently  arbitrary  and  that  .many  alternative  routes  tc 
similar  results  say  exist.  Further  experience  In  the  use  of 
such  analytical  processes  should  lead  to  lr.proverent  through 
refinement  and  perhaps  throurh  scac  acre  basis  changes  in 
approach;  consents  on  the  nethoda  asid  ooneluslcns  of  tills 
report  are  solicited. 

The  basic  cethed  reported  sas  developed  in  the  course  cf 
evaluation  vor fc  on  various  fuzing  and  firing  systems  In  the 
iocb,  rochet,  project;  ic  and  •ui.!e.-aata<-  ordnance  prograss. 

Ihe  analysis  of  the  experlsentaz  bomb  fuco  giver,  herein  is  to 
be  considered  exe-plary  only,  since  the  particular  design 
analyzed  Is  not  representative  of  a  co-.pletes  laboratory 
development .  This  ieport  *as  prepared  un..er  tasks 
oft-A2b-s3-l,  XCb-A2b-2C-l  ar.d  kCi  C7a-’12-25. 


cChN  7. 
Captain,  Hid: 
S.-.ssar.cer 
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1.1  the  Aserican  concept  if  the  laport-’.'va  of  the  individual 
and  the  desirability  of  reliance  on  advanced  weapons  as  a 
substitute  for  B33S  eanpower  in  creating  a  strong  defense 
would  lead  inevitably  to  eapliasis  cn  safety  to  the  user  In 
ordnance  design  and  utilisation  for  hunanltarian  reasons  alone. 
Up  to  a  certain  point  there  is  also  a  strong  eeonoolc  factor 
in  favor  of  safety;  this  is  particularly  true  in  the  levy 
because  of  the  potential  loss  of  a  major  ship  fro*  almost  any 
ordnance  accident.  A  morale  factor  wust  also  be  recognised! 
since  weapons  Bust  actually  be  used  (both  in  practise  exercises 
and  service)  to  be  effective  end  those  »ltn  poor  reputations 
safety-wise  sill  be  consistently  slighted. 

1.2  Conversely!  providing  safety  in  ordnance  design  tends  to 
increase  weapon  complexity!  development  lead  tlae.  and  cost 
(and  thus  to  reduce  availability)  and  to  reduce  reliability  and 
effectiveness.  Offense  being  part  of  an  effective  defense,  an 
owarly-safe  weapon  could  contribute  to  unsafety  of  a  fleet  unit 
by  failing  to  Intercept  an  attacker  or  by  being  so  complex  as 

to  be  unavailable  at  the  tlae  and  place  needed.  Balance  between 
safety!  performance,  availability  end  cost  is  therefore  of  the 
utmost  importance. 

1.3  Striking  the  many  b* lances  (such  as  tbs  right  time  to  give 
up  concealment  by  starting  an  attack)  involved  in  the  playing 
of  the  percentages  which  essentially  makes  up  Bllitary  tactics 
la  complex  and  difficult  enough  as  it  is  without  burdening  the 
fleet  forest  with  explosive  ordnance  safety  problems.  Slue 
for  training  la  limited  and  mist  not  be  wasted  either  in  having 
to  learn  complicated  safety  routines  to  make  up  for  hasardous 
ordnance  or,  oc  the  other  hand,  in  studying  the  extra  readying 
oparatlona  occasioned  by  excessive  complexity  added  in  the 
interests  of  safety. 

1.4  Everyone  Is  for  safety  and  agOinxb  sin,  bet  the  exact 
point  or  balance  in  safety  of  explosive  ordnance  is  a  point  of 
aoch  discussion.  The  ordnance  designer  dees  not  have  the  entire 
natter  is  hi:  hands,  sin-.*  maio  of  the  conditions  of  flatt  use 
are  determined,  re-examined  and  titered  by  others  in  the  navel 
establishment  who  are  primarily  concerned  with  tactics, 
logistics,  ship  and  aircraft  design,  etc.  These  people  cannot 
be  familiar  with  all  the  detailed  design  cr-siderstions. 
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manner-of-use  assumptions  and  closeted  skeletons  implicit  In  u 
piece  of  ordnance  hardware.  I.h.e  ordnance  designer  ^oes  hate 
the  following  responsibilities,  r,  soever,  which  he  should  not 
seek  to  avoids 

a.  Good  Dwjlrn.  A  safe  design  is  not  necessarily  rnre 
complex  or  unreliable  than  an  unsafe  one.  fiiere  will  always 
be  rsca  for  Ingenuity  and  careful  analysis  in  devising  and 
selecting  effective  saflng  systems  which  do  not  disproportion- 
ately  complicate  or  degrade  the  performance  of  ordnance. 

b.  Balanced  Design.  Each  feature  of  a  design  added  for 
safety's  sake  should  be  weighed  carefully  to  see  that  It  p»7S 
It*  may  in  Increasing  safety  to  an  extent  that  makes  up  for 
aqy  added  cost,  complexity,  handling  care  and  unreliability  It 
Introduces.  Seducing  one  hazard  la  In  vain  If  It  contributes 
to  Increasing  others  disproportionately. 

c.  Determination  of  Potential  Hazards,  if  safety  in  a 
design  Is  less  than  desired.  It  can  often  be  compensated  for  by 
handling  and  use  practices.  There  Is  an  obligation  to  explore 
possible  avenues  of  unsafe ty  to  Insu/e  that  no  serious  faults 
exist  unknown  and  to  make  Information  available  on  which  a 
decision  as  to  the  urgency  and  value  of  an  Improvement  In 
design  for  safety  can  be  based. 

Approaches  to  Safety 

1.5  This  report  Is  prlnarlly  concerned  with  fuzing  syste= 
safety.  In  spate  cases,  such  ax  In  nrojeetlles,  this  .way  Involve 
considering  only  a  "fuze"  Itself)  in  other  cases,  as  Jn  B»ral 
mines,  many  separate  components,  both  In  the  expendable  ordnance 
and  the  planting  craft,  fom  the  ordnance  saflng  end  firing 
system  and  must  U,  studied. 

1.6  Over  the  long  history  of  ordnance,  safety  has  been  sought 
by  various  approaches,  and  an  extensive  philosophy  tvs  Been 
developed  which  assists  an  experienced  ordnance  engineer  to 
arrive  at  a  safe  design  without  toe  many  false  ; tarts.  Some 
of  the  philosophies  which  have  evolved  may  be  summarized  as 
follows!  (many  of  the  finer  points  which  are  essential  to 
th«ir  real  usefulness  here,  of  Uvcwliy,  been  emitted  here, 

♦nd  this  should  not  be  considered  an  all-inclusive  list). 

«•  u*  Interrupted  Explosive  Train.  I  ills  design  feature 
has  achieved  virtually  the  status  of  a  pnllcsophy.  ly  stopping 
the  propagation  of  ar  accidental  Initiation  at  a  s-fc  pint.  It 
eliminates  sany  of  ti*  preblens  otherwise  asscciet-.d  .  ;„h  tb« 
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necessarily  graat  electrical  and/c r  mechanical  sensitivity  of 
the  prlncry  explosive  olexent  vhlch  initiates  the  woapon.  The 
location  of  the  Interruption  in  the  train,  setfcods  for  eval¬ 
uation,  etc.  are  well  established.  The  Interrupted  train 
alnost  invariably  coopllcates  a  design;  If  veil  designed.  It 
does  not  affect  the  reliability  of  the  erred  explosive  train 
but  the  mechanic?!  ope.  at!™  sf  truing  is  an  oudud  phase  or 
operation  »hlcb  can  rarely  be  100,.  reliable. 

b.  The  Fall-Safe  Principle  (in  which  failure  of  any  part 
tc  operate  Is  Bade  to  lead  toward  s  dud  rather  then  unsafe 
operation}  Is  invaluable  In  avoiding  accidents  froa  unforeseen 
possibilities  of  aal-treatment ,  mlsasseably  and  ataoraal 
environment.  Its  affect  on  reliability  Is  direct  ar.d  obvious. 

c.  The  Series  of  Safety  Features  principle  Is  based  on 
the  sound  assumption  that  it  is  easier  to  achieve  perfection 
by  designing  so  that  two  or  aore  Independent  sefety  feetures 
(of  a  read ily-deeonst rated  level  of  reliability)  oust  all  fall 
for  there  to  be  an  accident  than  by  relying  on  a  single  feature, 
which  anst  be  of  undeacnstrably  high  reliability  and  which  will 
fall  If  caltted  or  clrcuarented.  The  effect  of  these  edded 
features  cn  complexity  ana  reliability  Is  unfortunate  and  the 
aatter  of  actual  Independence  Bust  be  aoat  carefully  examined. 

d.  The  Orertest  Philosophy  seeks  to  deaonstrate  safety 
by  exaggerating  the  expected  service  environment  to  the  point 
where  failures  of  pert*  may  occur  or  where  It  Is  highly 
unlikely  that  an  equlval-nt  shock,  voltage  or  whatever  will 
ever  be  seen  In  practice.  If  failures  Induced  are  not  of  an 
unsafe  nature,  they  are  disregarded.  This  pragmatic  philosophy 
eeeds  out  many  questionable  features,  but  may  be  criticised  aa 
leading  to  overdesign. 

e.  The  Critical  Defect  classification*  wisely  requires  a 
higher  degree  of  Inspection  and  perfection  In  those  attributes 
of  an  Individual  piece  of  ordnance  which  affect  safety.  When 

a  great  many  parts  are  considered  to  -iffect  safety  (as  in  those 
Items  relying  cn  a  series  of  safety  features),  however,  there 
may  be  so  many  critical  features  as  to  dilute  available 
inspection  effort  to  the  extent  that  the  high  quality  level  Is 
not  actually  assured.  High  rejection  rates  where  many  dimen¬ 
sions  are  Critical  may  jscparcix*  production  and  lead  t- 
waivers  being  granted,  again  defecting  the  systen.  It  is  often 

•  Used  in  the  Ordnance  Classification  of  Defects,  a  Savy 
document  governing  ths  Inspection  and  acre-’aneo  of  ordnance 
material. 
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difficult  to  classify  attributes;  a  dimension  silently  cut  cf 
tolerance  may  affect  operability  only  -ut  becone  significant 
safety-wise  If  farther  out. 

f.  Arbitrary  Eesirn-Peature  Requirements  usually  result 
from  long  experience  ana  undoubtedly  have  kept  a  great  deal  of 
bed  orduauce  out  of  service.  Such  things  as  cocked  firing 
springs,  etc.  may  be  banned  because  of  their  contribution  to 
unsafety  In  particular  cases;  applied  In  other  cases,  such  bans 
■ay  not  really  apply  and  may  seriously  handicap  design. 

Perhaps  the  aost  serious  problem  Is  that  it  is  human  to  assume 
that  If  all  bant  and  requirements  are  compiled  with,  safety  is 
assured.  This  Is  not  true  beeeuse  of  the  Impossibility  of 
Including  In  any  list  all  ramifications  affecting  future 
designs. 

1.7  the  various  philosophies  furnish  much  assistance,  but 
thare  are  simply  tco  many  considerations,  some  of  them  at  times 
conflicting,  to  be  assessed  continuously  for  their  overall 
effect.  There  Is  also  the  possibility  that  so  many  safety 
features  sill  bo  la  series  that  the  net  addition  tc  safety  of 
some  of  them  Is  Insufficient  to  justify  their  cost  (using  cost 
In  the  Inclusive  sense)  while  other  accident  sources  which  are 
not  considered  because  they  do  not  happen  to  be  covered  by  the 
philosophies  are  of  much  greater  Importance. 

1.8  It  Is  the  purpose  of  this  report  to  discuss  the  methods 
and  possibilities  of  a  sere  all-inclusive  method  or  analysis 
which  attempts,  without  pr*-Judgeid*iiC  as  to  the  Importance  or 
unimportance  cf  individual  urobablllties,  tc  put  the  pieces 
together  Into  an  overall,  semtquantltative  picture  In  which  the 
total  effect  of  Individual  design  or  usage  features  can  then  be 
assessed  core  readily.  So  new  or  additional  test  methods  or 
design  features  ore  assumed  or  involved,  but  a  acre  penetrating 
(and  laborious)  method  of  analysis  Is  proposeo.  This  analysis 
cannot  eliminate  the  need  for  design  Ingenuity  or  the  con¬ 
duct  leg  of  test  pregrsms.  As  will  be  discussed,  however,  It 
appears  that  demonstrably  valid  conclusions  useful  In  design 
and  evaluation  een  often  be  reached  by  the  logical  combination 
of  existing  data  ant  reasonable  estimates. 

1.9  Xhlle  seme  or  the  thought  processes  involved  in  accident 
probability  analysis  are  similar  to  those  In  reliability 
analysis,  the  practical  handling  cT  the  precise  Is  almost 
completely  different.  Cne  fundamental  reason  for  this  Is  that 
there  ere  at  least  only  a  few  ways  In  which  a  system  -ten 
function  as  Intended,  while  there  are  almost  rupee: *e  .  -ays  In 
which  It  can  be  unsafe.  The  philosophical  approach  1c  -hlng 
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toward  a  conplete  safety  analysis  sust  tnerefore  be  basically 
different  from  chat  seeking  th»  closest  estinate  of  the  percent¬ 
age  reliability  of  a  weapon,  and  the  nathenatlcs  used  will  be 
correspondingly  different.  Jherever  concepts  related  to  those 
In  reliability  or  effecttv.-ne«s  analyst'  ere  use  5  hers,  a 
slnllsr  teralnolcgy  and  sysbology  has  been  sought,  but  in  cost 
of  this  analysis  the  selection  of  terns  and  syxbols  is 
arbitrary. 


5 

C0NF1DLXTUI. 


r-  n*<wu  wnrfl*  wraiumrsw  m»  ■ 


CCSFIDEHTIAL 
HAYCRD  REFffit  4135 

CKAFTH3  2 


THE  P.AF  ANAHTdlh 

2.1  la  ustncii  the  Relative  Accid<  nt  fro tab 12  I r-  Analysis  Is 
an  orderly  plan  for  breaking  the  complex  pretlcn  of  overall 
safety  of  sn  ordnance  item  Into  coxponent  parts  which  can  be 
assessed  by  logical  treatment.  The  first  sajor  breakdown 
separates  factors  of  situation,  exposure,  and  severity.  of 
these  three,  the  situation  Is  by  far  the  cost  coeplex. 

The  Situation 

2.2  A  "Situation*  Is  defined  as  a  period  In  the  life  of  the 
ordnance  during  which  the  environment  and  conditions  which 
affect  safety  and  the  results  of  a  presature  actuation  are 
essentially  constant.  This  neans  that  accident  likelihood  and 
consequences  are  essentially  of  one  averageable  value.  To 
Illustrate  this,  consider  a  1 lze  stored  with  and  without 
booster.  Here  the  environment  Is  essentially  the  sasie  bat  the 
results  of  premature  actuation  would  be  quite  different.  Two 
situations  would  result.  Cn  the  other  hand,  a  fuse  which  Is 
undergoing  setback  Is  under  very  different  envU-cnaental  con¬ 
ditions  fresi  one  sitting  on  the  shelf.  Here  the  situations  are 
■ore  obviously  different.  In  brief,  two  factors  are  Influ¬ 
ential  In  the  definition  of  situation.  The  first  deals  with 
the  likelihood  of  a  presature  actuation  which  depends  to  a  great 
extent  on  the  envlrooBent  and  the  nr* In*  status  of  the  ltea. 

She  second  deals  with  the  probable  results  of  an  actuation  and 
Is  aor#  of  a  convenient  and  necessary  artifice  which  will  he 
better  appreciated  when  the  severity  factor  is  discussed. 

2.3  In  the  RAF  Analysis  the  entire  life  history  of  the 
ordnance  ut  ordnance  component  Is  reviewed  and  the  situations 
which  are  likely  to  arise  are  listed,  this  encourages  a  syste¬ 
matic  consideration  of  the  factors  In  a  situation  which  Influ¬ 
ence  tba  safety  of  the  ordnance.  In  broad  categories,  the 
history  starts  with  manufacture  and  asseably.  This  Is  followed 
by  transportation  and  storage  and  delivery  to  fleet  units  for 
tactical  use.  Handling  and  stowage  on  units  of  the  fleet  usual¬ 
ly  differ  fres  handling  ashore.  In  aany  cases,  components  are 
assembled  to  sake  couplet*  weapons,  thus  changing  the  picture 
a:  far  as  lethality  and  daaage  potentiality  ore  concerned. 
Delivery  to  the  target  Involves  the  conditions  of  launching  and 
rraing.  Soae  ordnance  ehlch  was  prepared  for  use  will  not  be 
fired  and  will  be  returned  to  the  ssgazlsc,  ship,  o<*  i-t. 
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Although  these  bro3d  situations  oover  the  nornal  expected  lile, 
there  ere  other  situations  wh!-h  need  to  fce  considered.  These 
are  situations  which  are  net  Intended  or  desirable,  but  which 
cannot  always  be  avoided.  Some  exarples  are  fire,  airplane 
crashes,  hung  ordnance,  etc.  The  situations,  both  norcal  and 
unusual,  which  need  to  be  <ons!dercd  all',  depend  cn  the  type  cf 
ordnance  and  conditions  of  Its  use. 

Probability  Factor 

2.4  Before  beccalng  too  Involved  In  the  situation,  It  Is 
advisable  to  see  how  the  situation  fits  Into  an  overall  proba¬ 
bility  of  accident.  For  each  situation,  a  nusbar  Is  obtained 
which  Is  the  bast  estlaate  of  the  probability  of  an  accident  In 
that  situation.  This  mraber  Is  the  probability  factor  (PI. 

For  the  purposes  of  this  presentation  of  the  HAP  analysis,  an 
accident  Is  defined  es  the  explosion  of  the  booster  or  larger 
charge.  This  restrictive  definition  Is  used  only  because  the 
danger  of  explosion  Is  usually  the  primary  concern  In  consid¬ 
ering  overall  safety.  The  RAP  analysis  ecu  be  used  or  extended 
to  cospare  other  bad  effects  (such  as  the  opening  of  the  para¬ 
chute  on  a  alne  while  still  attached  to  tha  planting  aircraft) 
by  slzply  redefining  the  accident.  The  probability  factor  Is 
obtained  froa  a  situation  diagram,  a  procedure  which  will  be 
explained  In  detail  In  later  paragraphs.  A  distorted  picture 
of  the  overall  safety  of  the  device  rculd  be  obtained  If  the 
probability  factors  of  all  situations  sere  given  equal  weight, 
there  are  two  reasons  for  this.  First,  there  are  scow  situ¬ 
ations  which  are  coason  t,  ell  cevlces  and  soae  which  occur  In 
the  life  history  of  only  a  few.  Adjustments  Bust  be  Bade  for 
the  relative  frequencies  with  which  the  ordnance  Is  exposed  to 
the  various  situations.  Second,  the  effects  of  presature 
actuation  ere  far  aore  serious  In  seme  situations  than  in  other 
A  deview  which  is  aore  susceptible  to  actuation  In  a  situation 
where  the  consequences  are  aore  grave  oust  be  penalised  in  its 
comparison  with  other  devices.  A  factor  which  night  appear  to 
affect  the  weight  to  be  given  a  probability  factor  Is  situation 
duration.  Some  situations  extend  for  a  long  period  of  tine 
while  others  exist  only  a  aoaent.  However,  It  has  been  found 
that  this  factor  Is  best  handled  directly  In  the  situation 
probabilities.  The  most  lx portent  reason  for  this  Is  that  the 
situations  lx  pose  the  environments  which  m*  differ  sc  c-h 
i»  severity  an a  character  that  tlae  duration  as  a  seoarnta 
factor  may  be  meaningless  and  distorting. 
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Exposure  Fa. tor 

2.5  To  adjust  for  the  frequency  of  exposure  to  situations,  the 
probability  facto?  (PI  obtained  iron  a  situation  is  tailtiplled 
by  an  exposure  factor  (£).  The  exposure  factor  ts  dimensloQ- 
lass.  It  is  determined  by  the  average  master  of  tines  to  which 
the  average  piece  of  ordnance  *111  be  exposed  to  the  particular 
situation.  For  a  situation  such  as  initial  assembly,  its 
value  is  unity}  for  a  situation  such  as  "crash  aboard  carrier 
with  hung  ordnance"  It  *111  be  such  smaller,  while  In  sosae 
situations  such  as  "fuzing  missile"  involving  frequently 
disassenbled  ordnance,  it  cay  be  greater  than  unity.  The 
exposure  factor  Is  subject  to  change  by  changes  in  tactical 
doctrine,  field  handling  procedures,  etc.  (e.g.,  by  a  change 
from  a  doctrine  of  carrying  a  weapon  on  anti-subsarlae  patrol 
to  on*  In  which  weapons  are  sized  only  on  strike  missions) 
more  often  than  by  changes  in  design,  and  therefore  say  well  be 
retained  as  a  separate  figure  until  the  final  stage  of  an 
analysis,  to  facilitate  trying  out  tactical  or  handling  pro¬ 
cedure  changes  for  their  affect  on  safety. 


2.6  adjustment  for  the  consequences  of  an  accident  in  a 
situs  tier.  Is  cade  by  multiplying  the  probability  factor  Crl 
and  exposure  factor  (B)  by  a  severity  factor  is).  The  severity 
factor  is  to  represent  the  average  "cost"  of  an  accident  of  *na 
assumed  type  occurring  in  the  situation  considered.  "Cost" 
may  be  an  inclusive  term  including  not  only  the  direct  loss  In 
damage  to  material,  ships  and  installations  and  in  casualties 
to  personnel,  but  also  perhaps  some  estimate  of  the  loss  of 
tactical  capabilities  end  advantage,  compromise  of  secrecy, 
effect  on  corale,  etc.  The  degree  of  inclusion  of  these  in¬ 
tangibles  must  be  stated.  It  la  often  satisfactory  to  make 
the  severity  factor  a  relative  term  rather  than  an  absolute  one 
(as  by  considering  S  for  the  explosion  cf  a  fuze  booster  chile 


an  accident  jeopardising, a  carrier  es  10',  for  example).  This 
is  because  competitive  designs  being  analyzed  will  be  used  with 
a  similar  caln  weapon  charge,  involving  the  identical  hazard  if 
accidently  exploded  In  similar  aztualions.  me  o  factor  is  to 
represent  only  the  cost  associated  with  salfuaction  of  the 
ordnance  being  analysed;  it  ssould  be  an  estimate  of  the 
difference  in  cost  between  that  of  an  aircraft  accident  in  which 
a  teno  aboard  exploded  sr.d  cne  in  which  it  did  r.ot  In  situ¬ 
ations  where  the  dauage  varies  with  the  exact  tic->  i .  the 
accident  (as  In  the  esse  of  a  rocket  preeature  rfi.hi.  Jasage 
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rang®  of  the  launching  aircraft)  a  weighted  average  value  la 
worked  out,  subject  to  later  c.oser  Individual  analysis  if 
results  warrant. 

2.7  The  severity  factor  Is  essential  In  weighing  the  relative 
safety  of  ordnance  designs  ana  should  not  be  left  out  except  In 
waving  comparisons  Halted  to  one  specific  weapon  and  situation. 
The  figure  of  not  wore  than  one  accident  ^la  aalHion*1  often 
quoted  as  a  goal  for  navy  fusing  does  not  adequately  express  the 
true  need  for  ell  types  of  ordnance.  If  acceptable  tn  the 
planting  of  subearlne-lald  nines.  It  Is  clearly  excessively 
stringent  on  a  relative  basis  for  aircraft- laid  nines,  and  like¬ 
wise  If  acceptable  for  a  fuse  alone  Is  Inadequate  for  the  sane 
fuse  In  a  2000  lb.  boab  on  a  carrier  deck. 

Relative  Accident  probability  Index 

2.8  Tbe  product  PES  is  a  number  which  characterizes  tl.e  hazard 
free  the  device  in  a  situation  and  is  properly  weighted  for 
comparison  with  other  situations.  Since  F  Is  expressed  as  the 
probability  of  an  accident  In  a  situation  per  device,  £  is 
dimensionless,  and  S  Is  expressed  as  the  monetary  loss  por 
accident  (In  sooe  multiple  of  dollars),  the  product  PES  Is  tbo 
probable  relative  dollar  loss  through  accidents  In  a  situation 
per  device  -  an  Index  which  rates  the  hazard  free  the  device  In 
a  situation.  To  obtain  an  overall  picture,  she  Indexes  of  all 
situations  are  added.  The  result  Is  a  number  (APES)  called  the 
Relative  Accident  Probability  .rdax  (RAPI)  which  csi.  be  used  to 
compare  different  devices.  It  has  been  found  most  meaningful 
to  express  the  overall  accident  cost  attributable  to  the  use  of 
e  design  of  ordnance  In  terms  of  cost  per  unit  of  ordnance 
manufactured  or  assembled.  Such  figures  are  then  In  fore  to  be 
compered  with  the  cost  of  manufacture  cf  the  ordnance  unit,  with 
the  cost  of  use  (logistics,  firing,  planting,  etc.)  and  with  the 
tactical  usefulness  per  unit  (e.*.  shipping  daaage  per  mlno). 

2.9  An  additional  factor  may  be  recognized:  the  probable 
number  of  uriis  lo  be  used.  Since  this  can  always  he  cranked 
tn  at  the  end  of  the  process  without  crllnarlly  modifying  the 
figures  that  have  gone  before,  we  have  arbitrarily  chcscn  to 
exclude  it  from  the  RAP  analysis.  If  added,  this  factor  has 
th*  interesting  property  vf  tending  lo  reduce  the  erred  of  the 
severity  factor,  tbe  blgger-beng  liens  of  ordnance  for  other 
reasons  normally  being  used  in  ssallar  quantities.  The  total 
coat  of  eccldents  from  all  the  ordnance  of  a  given  type  r°iv~ 
factored  tends  to  be  core  constant. 
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2.10  of  tne  factors  discussed  normally  only  the  situation 
probability  factor  (P)  Is  complicated  to  understand  and  diffi¬ 
cult  to  basa  cn  known  values.  The  general  pro..;,  lure  for 
establishing  this  factor  will  be  considered  briefly  here;  since 
probability  factor  determination  is  the  nub  (and  the  biggest 
part  by  far)  of  the  HAP  analysis,  the  detailed  procedure  is 
discussed  in  the  later  chapters  on  Situation  Diagrams,  Pro¬ 
bability  Assignment  and  Summation  of  Path  probabilities.  At 
this  point,  a  glance  at  Pig.  4-3,  a  diagram  of  the  paths  to 
unsafety  In  one  situation  for  a  bomb  fuze,  may  help  clarify  the 
discussion  to  follow. 


2.11  The  analysis  procedure  to  determine  the  probability  of 
an  accldsnt  In  a  given  situation  is  akin  to  the  development  of 
a  complicated  wiring  diagram  from  component  circuits.  The 
whole  diagram  Is  far  too  complicated  for  normal  thought 
processes,  but  tha  Individual  components  and  circuits  are  quite 
simple. 

2.12  In  the  Rap  situation  probability  analysis,  the  Individual 
circuit  equivalent  Is  the  "accident  pith".  An  accident 
proceeds  from  some  "event"  or  happenstance  through  what  ever 
other  events  are  required  by  tha  design  of  the  ordnance  item 
end  the  circumstances  at  the  tin  to  the  explosion  of  the 
booster  and/or  sain  charge.  In  uost  cases  other  happenstances 
are  required  to  complete  the  pat.i.  The  events  are  not 
necessarily  In  time  sequence;  a  previous  event  such  as  omiss¬ 
ion  of  a  safety  device  In  aanufactura  may  become  part  or  an 
accident  path  later  when  some  other  untoward  event  starts  the 
accident  process. 

2.13  In  *  situation  wc  must  consider  a  multiplicity  of 
accident  paths,  for  there  are  alrcst  always  several  ways  In 
shich  safety  may  be  defeated.  The  only  meaningful  overall 
probability  cf  accident  for  a  given  situation  Is  the  sumrsatlo.. 
of  all  these  Individual  paths.  In  practice,  the  analysis 
process  approaches  this  figure  by  a  systenatlc  listing  of  all 
foreseen  paths,  their  arrangement  In  a  diagram,  and  their 
combining  by  appropriate  »xh.ra*;cs3  yccecccc. 

2.1*  tie  equivalent  cf  the  Individual  coononent  in  the  wiring 
diagram  is  the  "event",  a  single  happening  or  condition  whose 
prel ability  under  the  conditions  peculiar  to  the  situation  can 
be  estimated  fret  experience  or  s  priori  knewlecg .  v.  •  '-ater- 
xlaed  by  test.  Sxarcles  are  the  accidental  dropping  of  a  fuze 
In  such  a  turner  as  to  close  an  Inertia  switch,  the  snorting 


1C 

COHPIESkTIAl 


COKMEEHTIAL 
(UVOfai)  hKPCST  4135 


of  two  sires  in  the  process  c'  asseabllng  a  fure,  tue  ignition 
of  a  pyrotechnic  delay  columry  heat  fren  an  adjacent  explosive 
motor,  or  the  inappropriata  turning  of  a  safety  switch  in  an 
aircraft  ordnance  firing  circuit  control  box. 

2.15  The  keystone  of  the  Relative  accident  Probability 
Analysis  is  the  use  of  the  sane  value  for  the  saao  event  in 
different  designs  or  system  being  considered  in  each  case  «iiere 
the  seme  conditions  exist.  For  exaapla,  in  conparlng  two  mortar 
fuse  designs  externally  and  operationally  similar,  the  possi¬ 
bility  of  a  second  round's  be lug  dropped  into  the  nor tar  while 
the  previous  one  is  still  within  the  barrel  would  be  assumed  ths 
sana  for  each.  Since  Host  competing  system  include  many 
comxm  design  features  and  the  sane  external  factors  are  oper¬ 
ating  on  both,  it  is  often  possible  to  gst  an  appraisal  of 
their  relative  safety  that  Is  aora  accurate  than  the  knowledge 
of  the  probabilities  cf  individual  events  used  in  making  the 
analysis,  due  to  this  canceling  effect. 

2.16  When  the  whole  suaaatlon  has  been  made,  the  results  can 
reviewed  to  see  the  parts  significantly  responsible  for  the 
total.  The  product  of  the  probabilities  of  the  individual 
events  asking  up  each  path  is  the  probability  of  an  accident 
via  that  path.  If  this  path  probability  is  snail,  the  effect 
on  the  overall  safety  of  the  probability  value  of  each  event 
which  occurs  tally  in  such  low-probability  paths  is  also  small, 
no  Batter  ho*  high  the  individual  event  probability  .may  be. 
Conversely,  if  an  indie-dual  el ant  occurs  in  a  short  accident 
path  having  a  relatively  higher  probability,  its  value  has 
great  effact  on  the  answer.  These  relationships  make  the 
analysis  wary  effectlwa  is.  pin- pointing  design  features  where 
improvement  in  safety  can  best  be  sought,  in  selecting  areas 
in  which  determination  of  probabilities  by  tost  is  lsportaat 
and  warranted,  and  in  determining  the  maximum  change  in  overall 
safety  that  would  result  from  eliminating  a  safety  feature  or 
rrom  reducing  the  probability  of  some  ewent  tending  toward 
accident  to  zero. 

Purposes  of  the  RAP  Analysis 

2.17  Presently  foreseen  uses  of  the  24?  snnlysis  sre  -  'von  in 
the  following  parngraplis.  Specific  ways  In  which  a  particular 
example  of  u  RAP  analysis  could  be  used  «s  a  basis  fer  tech¬ 
nical  and  sdninlstratlwe  decisions  are  given  in  Chapter  9. 

Uses  of  the  Relative  Accident  Probability  *  .1-<s1s: 

e.  To  iTford  a  logical  procedure  for  considering  elx 
the  rentes  .u  unsafely  fay  an  cfaariy  consideration  of  the 
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things  that  can  go  wrong  throughout  the  life  history  of  a  furirg 
systea,  thus  avoiding  "bloopers." 

It  can  hardly  »a  assured  that  ill  paths  will  he  round, 
but  the  probability  of  missing  a  serious  path  Is  cut 
down  by  any  systesatlc  consideration.  "'Ms  Is  part¬ 
icularly  laportant  where  divided  responsibilities  are 
Involved  (BuOrd-BuAer;  Army  launcher  and  Navy  fuze; 
etc.)  and  there  Is  a  serious  likelihood  that  both 
parties  say  alas  checking  a  possibility  for  accident 
in  the  belief  that  the  other  Is  eware  cf  it  and  taking 
precautions. 

b.  To  channel  design  and  evaluation  effort  (safety-v*s«) 
Into  fruitful  channels  by  affording  a  fairly  quick  index,  a* 
priori,  of  the  net  benefit  possible  from  removing  a  hazard- 
contributing  possibility,  establishing  a  risk  more  closely  by 
test,  etc. 


There  can  be  little  gain  in  overall  safety  fro* 
eliminating  or  studying  a  hazard  which  is  not  causing 
accidents,  and  the  effort  Involved,  often  major,  nay 
represent  Inefficient  use  of  mcney  an<l  engineering, 
furthermore,  side  effects  of  the  change  aey  result  In 
a  worse  overall  situation.  For  example,  express 
highway  construction  might  result  In  Increased  total 
hazard  If  blowouts,  rather  than  collisions  and  other 
factors  which  superior  highway  engineering  could  reduce, 
were  the  principal  causj  cf  accidents. 

c.  l'c  foster  simplified  ordnance  design  by  permitting  the 
use  of  novel  types  of  saflng  or  the  elimination  of  some  exist¬ 
ing  design  requirements  if  the  alternative  systems  con  be  shown 
to  sfferd  equal  or  better  overall  safety. 

The  ultimate  criterion  of  a  safe  design  Is  that  it 
not  causa  accident  expense,  not  that  It  pass  certain 
tests  or  contain  certain  features.  The  cl.-r-r  the 
actual  use  of  this  criterion  can  be  attained,  the 
better  will  be  the  balance  between  safety,  operability, 
and  manufacturing  and  cevelopment  cost.  It  Is  our 
belief  that  money  and  i .lent  spent  on  overall  esti¬ 
mating  methods  and  their  application  will  yield  a 
greater  return  at  this  time  than  similar  effort  In 
ordnance  design,  test,  cr  specific  test-nathed 
developuert  programs.  This  is  true  only  because  of  the 
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generally  geed  safety  *hloh  Is  characteristic  or 
American  ordnance  at  present  and  the  extrere  cnsplexlty 
In  ordnance  design  which  Is  rampant  despite  earnest 
individual  efforts  to  fig-.i  it. 

d.  So  furnish  guidan-e  In  the  dptcTilcotion  of  l.anailng 
and  tactical  doctrine  for  existing  designs  of  ordnance  as  It  is 
affected  by  safety  considerations. 

Operations  ere  often  spoken  of  as  Involving  a 
"calculated  risk,"  usually  without  real  calculations. 
The  RAP  Analysis  furnishes  a  fresework  for  such  risk 
studies  and  therefore  core  realistic  guidance. 


Analysis  Xon't  Do 


T.lfi  RAP  Analysis  Sill  Rots 


a.  Estimate  within  a  close  range  the  accident  cost  end 
rate  for  an  ordnance  design. 


Ihe  Individual  probabilities  going  into  the  picture 
are  not  well  enough  established  In  cost  cases  to  be 
put  on  an  accurate  quantitative  scale,  and  the  s urina¬ 
tion  cannot  be  closer  then  the  average  of  Its  parts. 
This  Is  why  the  here  "Relative*  Is  Included  in  the 
titles  because  of  comtcn  tenet  appearing  In  tiiw 
analysis  of  different  coapetltlvi  designs  and  In 
different  situations  l'-  the  sene  design,  aany  valuable 
comparisons  can  be  side,  and  most  administrative 
decisions  can  be  cade  correctly  on  such  a  basis,  but 
the  answer  cannot  be  expected  to  be  e  XlOJf  wetter 
unless  It  happens  that  only  e  fet;  Individual  proba¬ 
bilities  ere  significant  In  the  ansi-T  and  that  these 
•re  cnes  cn  which  extensive  data  are  available. 
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ChAPTS  3 


SITUATIONS  IN  THE  LIFE  KISTOBi  Of  A  BC13  FUZE 

3.1  Tint  first  step  in  ttia  RAP  analysis  of  a  piece  or  ordnance 
la  tha  division  of  ita  complete  life  nistory  (from  a  specified 
initial  point  to  a  apeclfled  end  point)  into  analytically 
discrete  situations.  The  reasons  for  such  division  arc  dis¬ 
cussed  in  general  terns  in  paragraphs  2.2  and  2.3;  to  initiate 
tha  exposition  of  the  RAP  analysis  technique  by  specific 
exaaple,  this  chapter  introduces  a  bosh  fuze  chosen  as  tha 
ordnance  ita*  to  be  considered  and  gives  tha  reasoning  behind 
the  division  of  its  life  history  into  situations  preparatory 
to  the  analysis  corerad  in  detail  in  succeeding  chapters. 

The  Bomb  Fuse  EX-200 

3.2  In  selecting  a  fuze  to  be  used  as  an  example,  several 
fuses  sere  considered.  The  EX-200  aas  chosen  because  it  incor¬ 
porated  electric  arming,  which  is  a  relatively  new  method  for 
fuse  arming,  along  with  tha  usual  mechanical  interruption  and 
interlocks.  The  choice  of  this  fuse  was  further  influenced  by 
the  fact  that  the  development  stage  mas  nearing  completion  and 
it  aas  felt  that  an  analysis  of  the  fuse  would  he  profitable  in 
regard  to  tha  forthcoming  evaluation.  As  it  happened,  develop¬ 
ment  of  this  fuse  mas  subsequently  cancelled.  Hcvevcr.  the 
13C-200  turned  cut  to  be  a  good  choice  for  Illustrating  the 
method  because  its  complexity  required  consideration  of  a  wide 
variety  of  factors  in  numerous  combinations,  thus  giving  ex¬ 
perience  in  many  problems  in  such  an  analysis. 

3.3  Th*  ES-ICC  is  an  impact  fuze  for  an  athwartship  moll 
designed  to  detenato  the  GP  lorn  drsg  bombs.  The  fuze  »a$ 
designed  for  interchangeable  use  in  tombs  having  the  new  2.?8l 
inch  fuze  well.  It  contains  an  interrupted  expxosive  train 
with  a  positive  lock  on  the  "cut-of-llne"  reter  when  in  the 
unarmed  position.  T.ie  fuze  is  energized  elect”?  rally  -nd  the 
arming  and  firing  pyrotechnic  delays,  which  are  electrically 
fired,  arc  selected  by  means  of  control  gear  in  the  aircraft 
at  the  tl«  of  benb  release. 

Tha  ho*bardler  may  select  tso  fir In-  delay  times  (instan¬ 
taneous  and  50  ms)  and  two  different  a.j: ng  daisy  times 
(6.5±0.5  end  ICiO.p  seconds)  depending  upen  the  tactics  of  the 
cisslcn.  This  Is  accoaplished  by  t*c  du.l  position  selector 
switches  in  the  chargi-g  gear  (S-i  ar.d  SWg  of  Fig.  3-2  . 
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in»  ruse  comprises  three  scrarate  firing  trains,  each 
leading  to  a  ecnsoa  96  gran  tetryl  booster.  Each  tra'n  consists 
of  a  pricer ,  detonator  and  tet.vl  lead.  The  prlvars  are.  seated 
in  s  stypol  housing  and  extend  -town  Into  the  aluntnuE  dle-cast 
rotor  and  lead  hearing.  Ine  detonators  are  housed  lit  a  steel 
rotor.  All  electrical  components  aro  encased  in  the  potted 
stypol  housing.  Also  Included  In  the  al'v'lnua  die-cast  .sousing 
are  two  explosive  actuators.  Both  operate  switches  end,  in 
addition,  one  turns  the  rotor  Into  the  armed  position. 

3.4  Figure  3-1  is  a  schematic  diagram  of  the  electric! 
circuit  of  the  fuae.  The  circuit  diagram  shows  the  switches 
in  the  normal  non-operoted  position.  Arming  and  firing  tises 
of  the  fute  are  determined  by  the  choice  of  the  magnitude  of 
the  applied  voltage  and  Its  polarity.  If  a  charging  potential 
of  300  volts  is  chosen  with  a  polarity  such  that  the  grounded 
side  of  the  fuse  circuit  is  positive,  the  fuze  will  have  a 
nominal  arming  time  cf  6.5  second:  and  will  fire  instantaneously 
upon  Impact.  The  circuit  action  Is  as  follows!  The  applied 
voltage  charges  the  two  storage  capacitors  Ci  and  C3  and  fires 
the  actuator  Ai  which,  after  a  nominal  delay  of  2  seconds, 
operates  switch  Sp.  The  225  volt  diode  then  breaks  down, 
charges  the  condenser  Cg,  end  In  the  process  fires  the  actuator 
Ay.  After  4-1/2  seconds,  the  actuator  aligns  the  rotor  and 
operates  the  switch  £>2.  On  Impact  the  switch  R-SW-1  closes  and 
fires  both  the  instantaneous  and  50  ss  primers.  The  pricers 
•ill  fire  in  time  order.  If  the  opposite  polarity  Is  chosen, 
the  IH46  diode  will  prevent  current  flow  through  the  instan¬ 
taneous  primer,  allowing  only  the  50  ms  primer  to  fire.  Thus 
the  choice  of  a  cnarging  potential  of  300  volts  provides  an 
arming  time  of  6.5  seconds  (2  seconds  fro:  the  actuator  A> 
delay  time  and  4-1/2  eeconus  from  the  arming  actuator  A2  delay 
time)  and  the  choice  of  the  polarity  detemlnes  If  the  firlnr 
on  impact  is  instantaneous  cr  Is  delayed  %  milliseconds. 

3-5  If  a  10  second  arming  delay  Is  desired  with  Instsntanecu : 
firing  upon  impact,  a  195  volt  charging  potential  is  chosen 
■1th  a  polarity  such  that  the  grounded  terminal  or  the  fuze 
is  positive.  The  condonsers  Cj  and  Cj  and  the  actuator  A, 
operate  as  described  above.  However,  in  this  case  the  225 
volt  diode  will  net  function  since  the  applied  voltage  is  le--s 
than  its  breakdown  potential.  Instead  Che  storage  condenser 
Cj  discharges  through  the  unC  circuit  coaposed  of  itself.  Hi 
and  Cj.  These  eor.ocnents  are  so  chosen  that  there  rill  rc  a 
3-1/2  second  delay  before  condenser  Cj  charges  to  -  sufrtclenr 
potential  to  break  down  one  of  the  low  voltage  (I1C)  d fades, 
ihen  the  dlcie  fires,  the  4-1/2  second  dele-  actuator  (Ay)  Is 
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activated  and  the  fuse  arns  approximately  4-1/2  seconds  later. 
Firing  cf  the  Instantaneous  and  50  ns  p.  leers  occurs  upor. 

Impact  as  described  above.  If  10  second  arming  with  50  cs 
firing  delay  Is  desired,  the  polarity  of  the  195  volt  charging 
potential  is  reversed.  The  circuit  action  is  Identical  as 
before  with  the  exception  that  the  opposite  low  •_!>. age  diode 
passes  current  and  fires  the  4-1/2  second  actuator.  The  two 
diode-  are  connected  in  parallel  with  reversed  polarities  tc 
provide  for  the  two  polarities  of  the  charging  potential.  Only 
the  5C  ms  prinor  fires  as  described  above. 

3.6  The  condenser  Cs  which  Is  also  charged  along  aitn  the 
condenser  C,  during  the  charging  ot  the  fuse  is  connects-1 
through  an  Impact  switch  designated  H-SVi-2  In  Figure  3-1  to  a 
shorting  switch  and  an  eleven  second  delay  primer  Ir.  parallel. 
The  shorting  switch  operates  by  the  action  of  tha  two  second 
actuator  Ap.  It  provides  for  sterilisation  of  the  fuie  In  tha 
event  a  premature  Impact  sufficient  to  operate  the  ".Jiggle" 
switch  occurs  within  two  seconds  after  the  fuse  is  charged.  If 
an  impact  occurs  after  two  seconds  and  before  the  selected 
arsing  tine  of  6  or  10  seconds,  the  arsing  actuator  A?  and  the 
switches  It  controls  will  not  have  operated.  Hence  the  instan¬ 
taneous  and  50  sts  primer  will  not  be  fired.  However,  the  11 
second  primer  will  be  Initiated;  the  fuxe  ncantlac  will  have 
cospletsd  Its  c ruing  cycle. 

3.7  Also  shown  In  Fig.  3-1  la  the  rotor  lock  shaft  and  the 
drip  switch  S3.  The  drop  switch  within  the  fuxe  Is  restrained 
by  a  shear  disc  until  the  Instant  of  drop.  The  extended  shaft 
of  the  drop  switch  locks  Into  a  hole  In  the  rotor.  In  the 
event  of  premature  action  by  tha  arming  actuator  Ap  or  the 
primer  and  detonators,  the  rotor  would  be  held  In  tho  unarasd 
position,  then  the  drop  switch  has  acteu,  by  the  pulling  away 
of  the  charging  Insert  and  plug,  Its  extended  shaft  Is  withdrawn 
from  the  rotor;  howevar,  the  rotor  Is  still  held  In  tlse  safe 
position  by  a  shear  wire.  After  about  two  Inches  cf  free  fall, 
the  drawing  out  of  the  charging  cable  cause »  seltchlct  to  be 
ccnpleted  in  the  bomb  rack  which  allows  the  charging  voltage  to 
bo  applied  to  the  fuze.  Voltege  Is  applied  until  the  disc  Is 
sheared  slid  the  charging  Insert  Is  pulled  away  freu  the  fuze. 
This  occurs  after  about  6  Inches  cf  free  fall.  The  release  of 
the  shaft  also  operates  switch  St  wnich  disconnects  the  internal 
circuit  or  the  fuze  from  the  external  ccr.tnets.  The  switches 
designated  In  Fig.  3-1  ss  3-5.S-1  and  U-Sw-2  close  lira  circuits 
from  the  condensers  tc  the  primers  ujen  Impact.  They  ere  en¬ 
cased  in  the  stypol  lousing  and  are  ex.-. -direction =11'-  sensitive, 
snd  they  operate  on  37  g  of  greater  lapaets. 
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3.6  the  charging  £ear  located  In  the  plane  Is  shewn  scheiat1- 
cally  in  Fig.  3-2.  At  any  tier  up  to  the  Inst:,  .t  of  eror.  the 
pilot  or  fccrbard ier  nay  select  the  art lap  and  firing  delays 
desired,  These  delays  are  established  by  the  selection  cf  the 
positions  of  ts Irenes  Kj  and  fcitp  respectively.  The  only  cther 
s»ltch  regaining  for  the  bcutardler  to  e-erate  is  the  tori' 
release  switch  or,  if  need  be,  the  bent  jettison  switch. 

3.9  The  cor.tlnation  of  eleetrical  arcing  end  charging  is  a 
relatively  new  and  untried  .ysten  for  L’nited  States  beat  fusing. 
The  forces  associated  Kith  rrea  falling  tocos  which  are  ncr- 
Efelly  used  as  a  scans  cf  arsing  do  not  readily  lend  thocsolves 
to  fusing  systems  for  lor.  drag  beebs  since  the  recuiresents 
prohibit  tire  use  of  arsing  wires  and  air  vanes.  Because  cf 
these  design  restrictions.  It  teccces  necessary  to  depeud  upon 
the  aircraft  charging  systea  for  part  of  the  safety  which 
cannot  be  designed  into  the  fuse.  This  is  sceoeplished  In  the 
UC-2C0  fusing  SyateK  by  installing,  in  series  with  the  firing 
lead,  switches  and  interlocking  relays  which  prevent  the  fcur- 
glalng  current  frna  getting  to  the  fuse  input  tcr.-inals  until  tic 
desired  tine.  Sene  of  these  switches  arc  shown  in  fig.  3-2. 

SUj  is  a  -pull-out  operated  and  shorting  switch."  While  in  the 
norcnl  position,  this  switch  naintalus  a  short  acrcss  the  fuse 
input  tersinals  and  Interrupts  the  firing  circuit.  This  switch 
is  operated  by  the  falling'  boob  as  it  drops  free  of  the  rack. 

The  series  connected  shackle  Interlock  swttches  designated  SW3 
and  SW4  break  the  firing  circuit  as  lo-g  as  the  shackles  are  In 
closed  nosition.  These  switches  close  ss  the  shackles  open  to 
release' the  boeb.  The  ir'.erlcch  relay  designated  nBj  also 
Isolates  the  firing  circuit  frea  the  plane  suprly  voltage. 

This  relay  is  activated  by  the  bent  release  switch,  in  addi¬ 
tional  switch  not  shown  in  the  schenstlc  was  proposed  Tat  use  in 
the  lending  gear  te  Interrupt  the  charging  circuit  alien  the 
lai-ding  gear  was  down.  This  was  to  provide  additional  safety 
during  fuzing,  take  off  and  lauding.  The  final  switch  is  the 
caster  arcancnt  switch  which  controls  all  the  arnaccr.t  power 
and  rast  tc  closed  before  dropping.  Thus  a  ainicua  of  6 
switches  is  used  to  add  to  the  safety  of  the  fuzing  syutea. 

3.10  gftar  the  tout,  is  in  Flaee  in  the  rack,  the  fuze  is  pushed 
up  into  the  well  frou  below,  and  the  retaining  plug  is  screwed 
in  and  tightened.  The  charging  plug  rros  the  hnnt.  -»n 
then  be  inserted  into  the  fuze  at  any  tin*  before  take  err. 

3.11  trior  to  crop,  the  occbardier  has  selected  the  arcing 
end  firing  delay  desired  by  choosing  the  proper  settings  of  the 
charging  gear,  Frca  this  point  cn,  the  ao*.  "  drop  is  the  sace 
as  for  any  norsnl  bosb  release.  At  the  instout  cf  drop,  the 
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boat  release  Mitch  is  pressed;  this  ooerates  the  interlock 
relay  She  charging  voltage  then  .'opcars  at  the  switches 

in  the  bocb  rack.  At  the  saoe  vise  the  boab  release  solenoid 
is  activated;  the  shackles  begin  to  open  and  when  opened,  close 
the  snaekle  interlock  switches  After  about  two  Inches  of  free 
fall,  the  "pull-out  operated  shorting  and  charging  switch"  SVe 
causes  switching  to  be  ecspleted  is  the  tosh  rscK,  unshort  inf 
the  fuze  input  and  applying  voltage  to  the  fuze  until  the  disk 
Is  sheared  and  the  charging  insert  is  pulled  away  Pros  the  best. 
Arnlng  then  proceeds  as  described  in  the  paragraphs  cbose. 

Division  of  life  History  into  Situations 

3.12  The  life  history  of  a  fuze  such  as  the  BX-200  is  sad*  op 
of  several  periods  which  have  been  defined  in  paragraphs  2.2  and 
2.3  as  situations.  In  order  to  cake  these  divisions, it  is 
necessary  to  study  the  envlroneeats  in  which  a  fuze  finds 
itself,  the  state  of  us* (ably  sad  arcing  of  the  fuze  end  the 
severity  of  any  accident  which  Bight  occur  in  these  enrlron- 
aents.  Backtracking  a  little,  it  appears  that  the  life  history 
of  fuzes  falls  into  two  aora  basic  periods  of  its  existence, 
which  are  in  turn  divisible  into  situations.  The  fuse's  life 
begins  after  its  aaxufaeture;  then  there  follows  a  period  of 
■hat  alght  be  considered  a  latent  existence  during  which  the 
fuzes  are  bandied  in  large  groups  or  lots.  It  perforas  no 
functions  and  hex  very  little  Influence  on  other  ordnance. 
Transportation  usually  takes  piece  In  sealed  containers  or 
iaaunition  carriers  froa  the  loading  plant  to  a  place  of  storage, 
where  it  is  kspt  for  an  indefinite  period  of  tine.  During  this 
so-celled  quiescent  period,  the  envlronaent  of  the  fuse,  while 
varying  froa  tine  to  tlae  with  handling,  transportation,  ambient 
temperature,  etc.,  is  within  averageable  Units  for  the  purpose 
cf  setting  up  a  situation.  Another  consideration  is  the  result 
of  a  prenature  actuation.  As  will  be  seen  later,  the  results 

of  a  pronature  action  In  this  early  period  of  a  fuze's  exist¬ 
ence  will  be  quite  different  and  considerably  leas  severe  than 
in  any  other  period  of  its  life. 

3.13  After  a  period  of  tlae,  the  fuze  will  be  renoved  trot 
storage,  transported  to  a  now  locality,  unpacked  and  aade  ready 
Tor  the  us*  for  which  it  was  annaf altered.  It  Is  at  this  point 
teat  the  resalnder  of  a  fuse's  life  cycle  passes  aonparatlvely 
fast  as  compared  to  its  storsga  existence,  acre  tne  fuse  ri:<£ 
Itself  in  severcl  different  environments  which  say  change  -ather 
abruptly  and  on  which  the  prospect  of  prenaturw  wstuatic:.  nay 
greatly  aepend.  In  addition,  since  the  fuze  is  new  associates 
with  larger  quantities  of  explosive  and  Is  in  the  arcxialty  at 
vulnerable  equipsent  cf  war  such  as  planes  and  ta!.  the 
severity  of  a  rrea.ture  actuation  is  increase::  cons  'ierably  as 
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ccopared  to  th»*  its  l'lrst  period  e."  existence.  Thus  It 
seems  that  tro  basic  (actors  determine  the  beginning  -  nd  end 
points  of  a  situation.  They  s.o  (a)  the  environment  and  3tate 
of  arcing  ihlrH  Influ'ne?  the  .rests  which  stay  causa  premature 
actuation,  and  (0)  the  results  0f  a  premature  actuation. 

3- 14  The  first  situation  tr.en  In  the  Hie  history  -f  this  fuse 
entails  all  of  this  first  basic  period  cf  existence  and  Is 
called  storcro.  handlin'*  ar.c  trahspc.tat jen  outside  of  ordnance. 
In  case  It  did  become  Initiated,  the  explosion  wculs  probably 
be  confined  to  the  ammunition  carrier  and  there  would  be  Insig¬ 
nificant  damage  to  the  storage  area.  In  essence,  this  situ¬ 
ation  Is  made  up  of  the  events  that  say  occur  free  the  time  or 
assembly  tlirough  storage  and  transportation  to  the  point  of 
unpacking  Just  prior  to  the  fusing  of  the  bombs.  Inis  division 
is  adequate  for  this  fuse.  Other  fuses  requiring  preparation 
(such  as  applying  arsing  wires)  may  warrant  division  Into 
additional  situations. 

3.1>  After  a  fuse  Is  unpacked  and  cade  ready  for  use,  it  Is 
here  that  Its  second  period  cf  life  begins.  After  the  protec¬ 
tion  of  Its  container  Is  removed,  It  is  inserted  Into  the  ruse 
sell  of  the  bomb.  This  situation,  known  as  fusing,  exists  for 
only  a  short  period  cf  time.  It  begins  with  the  insertion  of 
the  fuse  Into  the  well  and.  ends  with  the  closing  cf  the  con¬ 
tainer  cover.  The  fuse  Is  now  In  a  different  environment  as 
compared  to  that  of  transportation  and  storage.  The  likelihood 
cf  being  dropped  or  spuriously  Initiated  Increases  as  It  Is 
handled  during  removal  fro*  the  container  and  Inserted  In  the 
bomb.  The  severity  of  an  accident  nay  be  Increased  by  the  feet 
that  the  fuse  and  temb  arc  brought  together  physically.  Similar 
tc  fusing,  there  Is  tha  r« versa  situation  cf  defusing.  This 
situation  exists  because  thare  may  be  reasons  for  removal  of 
the  fuse  from  the  boab,  as  would  be  the  case  ir  tactical  plans 
had  ci-uigea  ana  benbs  cannot  be  stored  In  s  fused  cendltlcn. 

It  Is  likely  that  the  defusing  situation  would  be  nore 
hazardous  than  fusing,  since  electrical  connections  my  have 
been  made  and  the  plane  say  have  been  In  flight  and  subjected 
to  the  environment  associated  with  normal  flight.  It  .s 
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considered  that  the  tice  required  for  defusing  and  the  sever¬ 
ity  In  case  of  an  accident  would  be  the  sate  as  for  fuzing.* 

3.16  After  the  bomb  Is  fuzed,  there  »y  be  occasions  that  *111 
necessitate  the  liendllng  of  a  fuzed  bcab.  This  night  occur  If 
ti:»  boob  has  to  be  recoved  from  one  plane  to  another.  This 
operation,  or  situation,  Is  designated  as  fuzed  boob  handling 
and  Includes  all  events  following  the  act  of  fuzing to  the 
actual  connecting  tc  a  plane.  During  the  situation,  the  fuzed 
boob  may  be  transported  In  a  boob  carrier  frea  one  part  of  the 
deck  to  another,  passing  In  the  proxlxlty  of  other  boots  or 
planes.  There  exists  the  possibility  of  collision  with  objects 
cn  the  deck,  or  the  bocb  falling  fron  the  carrying  vehicle.  In 
tnis  particular  Instance,  it  has  been  pointed  cut  In  paragraph 
3.12  that  the  normal  procedure  would  not  Involve  the  handling 
of  a  bocb  fuzed  by  the  LX- 100.  However,  it  Is  anticipated  that 
operating  conditions  could  cause  deviations  free  this  aortal 
procedure  often  enough  to  require  Its  Inclusion  In  the  analysis. 

3.17  After  the  boob  Is  fuzed,  the  electrical  connections 
between  the  fuze  and  plane  have  to  be  made.  Here  there  la  a 
marked  change  In  the  environment  of  the  fuze  because  It  Is  new 
under  the  influence  cf  the  electrical  system  of  the  plane.  A 
path  to  Its  Internal  circuitry  has  been  established  and  the 
probability  values  assigned  to  the  events  of  the  situation  are 
affected.  The  connecting  of  a  fuzed  bocb  to  the  airplane  thus 
becomes  a  situation,  the  act  of  making  physical  connection  such 
as  the  engaging  of  the  bocb  lugs  rust  be  considered  In  the 
situation,  although  normally  this  would  be  done  before  the  bocb 
Is  fuzed. 

3.18  After  the  razed  bocb  Is  connected  to  the  plane,  there  will 
be  last  minute  checks  of  switches  and  electrical  connections. 
During  the  check  out  period  there  exists  a  possibility  of  cer¬ 
tain  critical  switches  being  pushed  and  even  the  chances  or 
accidently  dropping  the  bomb  froa  the  rack  onto  the  deck. 
Although  the  severity  of  an  accident  during  this  check  cut 
period  Is  probably  no  higher  than  whan  the  fuze  Is  celng 
connected  to  the  plane.  Its  envlronajnt  has  changed  to  tne 

•  The  ucc Panic al  factors  Involved  la  fuzing  and  defusing 
are  often  opposite  la  direction  Us  la  the  case  of  a  fuze  that 
Is  screwed  into  a  projectile)  and  nay  therefore  be  orofoundly 
itff Croat  la  effect,  particularly  If  lcgiesl  (though  perhrps 
unauthorized)  methods  are  used  which  apply  loads  In  'in intended 
locations.  In  mechanical  fuses  particularly  these  factors  oust 
be  very  carefully  considered. 
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IrfU»«5?e  {“2e  ?s  no*  ~0Te  than  a'JCT  under  the  influence 
“«£•  electrical  sys tea  of  the  plane  so  chat  this  c-'ock'nr  rat 

•ttdrtlSL4®8*  'Cre  £2SS=efi  1=  necessarily  a  separate  ^ 

off9  ^.r1f.S:SUa*lca  t1'  *hlch  11  fu2=  finds  Itself  Is  ra>e- 
■  *  pui  i*  e  shor.  period  of  t ice  bar-inning  at  the  tina~the 

pi£no  ha;  bean  giver,  the  signal  to  tekeTofr -Intil  it  l;“lr- 

cwrieJ0  *e-fl,«Tr  of  *?  acclde,lt  *hich  =l«ht  affect  the 
thSt  lt*ls*nn;  a,ehan«?  ,n  the  fnw's  environment  in 

_y?_  **  ls  n°*  exposed  to  launcning  accelerations  and  Diane 

features"5  lS1tLaiif?rf(P°SSlbly.defeat  scae  of  lts  mechanical 
sSetS  hiork^S!  e?ar  J*  retracted,  an  additional 

2!»!5y  plaaa  s  electrical  power  systas  Is  rc- 

SJ«it;hSt^*?2tInS^hee.probabllUy  of  extraneous  charging 
?£*-*!?«♦  ?!«  -  into  the  fuxe.  The  severity  of  an  accident  in 

t^the^M??  f?/fduc!;!  soaewhat  by  the  fact  that  the  danger 
:?  P!*®  •“*  to  ciher  planes  cn  the  carrier  Is  decreasing 

^  <lty tioa  progresses.  Closely  associated  with  the  taka* 
off  situation  Is  the  period  of  normal  flight.  The  severity  of 
“  i=  geetly  reduced  since  tKrf^lerisno^ef 

?h.rSf  ^ri^0”rr^h3  foment  Is  much  the  sa=i  « 

.J  °fr‘  te  i^ece  •«  Situations  the  electrical 
MtlS  fLt^.PJSn?v“d_^*  charging  gear  are  tha  prcdoal- 
thJ^nhSSJ???  ta,th#  e^ironnent  of  the  fuze  and  they  Increase 
the  probability  of  spurious uy  lnltletlng  the  explosive 

SSSS^iki  cff‘toiVU?t1??  Includes  the  events  fro. 

trying  todropf  *  intentional  drop  or  return  to  bass  without 

minion  in  the  Ufa  history  of  a  fuze 

a  fWi  llfeCf0r  n;i^°hHTt^t1,?P  *Vhe  situation  In 
Zhirh  owe  that  It  performs  the  work  for 

eJ?t^fd,.?nd  «t  the  end  of  tha  situation  Is 
fW^^tl^1^5^^4}?1  d2ClUd!T  the  events  which  night  occur 
JJ*  time  the  bomb  Is  rexeesed  until  It  Is  safely  sei>arat«d 
from  the  plane-  Here  tha  safety  features  of  the  plane  are  no 

lnltIatlS«CniIStofC^'nt  ?*s,beer-  *PFii«>  to  the  fuze 
i?™* iefa*0**?  °r  th*  e^piosive  cccpcnents  within  a  lethal 
raaf*  °f  the  plana,  and  also  at  tha  lnsisnt  of  drop  tha 
F?*1?**?  mechanical  Interlock  Is  removed.  The  probability  of 
tb>  bcwb  °clag  ttftly  separated  from  th*  piano  before  tfc* 
occurrence  of  an  accident  depends  now  on  alseui  riiLr  !, 
d*ftfcIe«TI'iI..*lncea*,,’y  of  tf!e  I,fety  features  have  been 
SDeclal  casa  n^^„IL.JnjT'“IS  =?*  cnvironnenl-  Jettison  is  a 
special  ca.e  of  normal  drop}  since  the  fuze  has  not  been  arced 

s*-?uid  J*  less.  Therefore,  no  sr'ciel  sicuaticn  is* 
caUed  for  unless  there  Is  some  peculiarity  o  iue  nrocess 
necessary  for  Jettisoning  which  Sight  c-.-.n^e  -7  st?£? 
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3.21  Although  the  life  of  a  fuze  should  ha re  ended  after 
nontal  drop,  there  are  frees  ions  when  is  desirable  to  return 
aboard  the  aircraft  carrier  without  dropping  the  ordnance.* 

For  this  reason,  it  is  necessary  to  consider  the  events  which 
night  occur  on  the  return.  It  is  evident  that  Loth  nornal  and 
abnormal  situations  can  exist  whan  a  plane  returns  with  its 
tents ,  and  these  conditions  create  different  envlronzents  for 
the  fuze  ehlch  necessitate  the  defining  of  separate  situations. 
The  first  consideration  will  be  a  return  with  nornal  landing.. 
This  situation  is  aade  up  of  the  events  which  night  occur 
during  the  landing.  The  events  will  be  slallar  to  those  during 
the  taka-off  situation.  Preparations  were  sade  to  drop  the 
bomb,  but  it  was  not  dropped'.  In  this  situation,  it  is  assured 
that  the  ordnance  and  plane  are  in  a  nornal  condition  during 
the  landing. 

3*22  Several  types  of  abnormal  situations  can  develop  during 
the  return  and  landing  with  beats.  Tha  environment  of  these 
situations  waves  it  necessary  to  establish  separate  situations. 
A  situation  can  possibly  arise  when  an  atteapt  was  made  to  drop 
the  bcah,  but  tbs  drop  was  unsuccessful,  resulting  in  the 
situation  of  return  etui  landing  with  hung  ordnance.  Tins  lc=ii 
release  and  Jettison  snitches  nave  been  closed  a ni  possibly 
tha  fuse  charging  switches.  Sees  walfunctioa  prevented  a 
nonaal  drop  but  the  extent  of  this  is  not  known.  In  this 
situation  it  !e  assuaed  that  the  ordnance  cooes  off  on  the 
landing.  The  events  of  the  situation  are  influenced  by  the 
arts  of  closing  the  switches  during  flight  and  the  mechanical 
inpacts  of  the  fcocb  as  it  rolls  or  slides  down  the  deck. 


3,23  ether  situations  will  c"»e  into  the  picture  when  a  crash 
landing  of  tha  plane  occurs.  One  situation  under  rush  an 
environment  would  be  that  cf  crash  on  landing  with  tang 
ordnance.**  Here  It  It  assuaed  thafthe  comb  is  dislodged  and 
tha  charging  plug  nay  be  detached  frox  the  fu*e.  There  is  a 
slight  chance  that  the  fuze  is  charged.  Another  situation 


•  Sines  it  would  always  be  desirable  to  bring  the 
ordnance  back  aboard  as  contrasted  to  jettisoning  the  beeb  or 
ditching  the  aircraft,  thla  situation  should  ba  considered  in 
a uf  analysis  in  the  hope  of  showing  that  bringing  it  back  is 
also  safe.  If  the  hope  is  net  borne  out,  restrictions  can 
then  be  placed  in  the  us*  doctrine. 

**  Sitn  small  bombs  it  may  be  necessary  to  consider  a  benb 
hung  by  one  lug.  This  situation,  which  wss  not  considered  in 
this  analysis,  could  be  considerably  core  dangerous  since  tr.s 
charging  plug  nay  have  pulled  out  norsally  a  hen  th.  c  -  •;  was 
atteepted. 
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which  presents  itself  would  te  crash  on  landing  with  rorcal 
ordnance,  This  involves  the  events  wETch  ccula  occur-during 
what  started  out  to  be  a  normal  lending  tut  resulted  In  a  crash 
of  the  plane. 

3.24  Keeping  in  view  the  ’vents  tliat  ha -.pen  after  a  crash  on 
landing,  two  final  situations  are  described.  If  a  tos.t  is  not 
detonated  during  a  crash  landing,  disposal  operations  cust 
follow,  The  tor.b  say  be  defused  or  It  night  be  disposed  of  by 
letting  It  slide  overboard  without  defusing.  Thus  the  rend¬ 
ering  ordnance  safe  or  disposal  of  crd-iance  after  crash~*Ian*dlng 
Is  a  situation  node  up  of  events  which  are  pertinent  to  this 
operation.  It  does  not  include  defusing  by  the  normal  method 
discussed  In  paragraph  3*17. 

3.25  The  final  situation  to  be  considered  is  that  of  resowing 
the  bggb  from  the  plane.  It  nay  or  soy  not  necessarily  be 
Influenced  by  the  crash  environment,  but  includes  the  recoving 
of  a  fuzed  boob  fron  the  plane  for  any  reason.  It  Is  not  a 
norzal  procedure  to  recove  a  fuzed  bor.b  free  a  plane  so  It  Is 
most  likely  to  be  an  operation  caused  by  a  crash  landing  and 
Influenced  by  that  environment.  The  recoving  of  a  fuzed  bo-.b 
free  a  plane  Is  discouraged  In  bombs  using  the  ilX-200  fuze,  by 
the  fact  that  the  fuze  Is  easily  removed.  The  resova)  of  a 
fuzed  bonb  Is  cost  likely  to  take  place  In  a  situation  where  It 
Is  physically  Impossible  to  de.uxe  the  bomb,  sue:,  .i  in  e 
crash  landing. 

3.26  Table  3*1  lists  th~  situations  Into  which  the  life 
history  of  the  KX-200  has  teen  divided  for  the  Initial  RAP 
Analysis.  It  Is  usually  necessary  to  further  define  In  writing 
the  end  points  of  the  Individual  situations  in  caking  up  a  list 
for  use  as  a  working  reference  In  an  actual  analysis;  this  has 
not  been  Included  here  because  of  the  uncertain  status  of  the 
UC-200  design  which  makes  It  difficult  and  unprofitable  to 

pin  down  certain  assembly  and  use  procedures  which  had  not  been 
firmly  established. 
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TAB  It  3.1 
Situations 

*.  a.  Storage,  Handling  and  Transportation  Outside  of  Ordnance 

<  b.  Fuzing 

.  e.  Da fuzing 
d.  Fuzed  Bcab  Handling 
a.  Connacting  Fuzed  Eoab  to  ilrpzane 

f.  On  Deck  Before  Take  Off 

g.  Taka  Off 

h.  Flight 

I.  Scrmal  Drop 

J.  Ha turn  altb  Horcal  landing 

k.  Saturn  and  Landing  with  Hurg  Ordn*nca 

l.  Crash  on  Landing  with  Hung  ordnance 
a.  Crash  on  Landing  with  Korsal  Ordnance 

n.  Wandering  Ordnance  Safe  or  Olsposal  of  Ordnance  after 
Crash  landing 

o.  Saco7lng  Boab 
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FIS.  3*1  EX -ZOO  SCHEMATIC  DIAGRAM 
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SITUATION  DIAGRAMS 

4.1  Situation  diagrams  are  full  of  events  having  probabilities. 
There  nay  be  a  rrobability  that  the  detonator  is  supersensi- 
tlvo;  a  probability  that  a  rotor  was  net  installed;  a  proba¬ 
bility  that  shoots  have  broken  a  pin;  ete.  Cor,c  of  these 
events  will  be  In  series;  l.e.  safety  is  not  defeated  unless 
ail  the  even's  occur,  ethers  will  bo  in  parallel;  l.e.  either 
event  circumvents  safety.  Situation  diagrams  involve  «  lot  of 
manipulation  of  the  probabilities  of  these  events  and  in  this 
respect  there  are  certain  rules  which  apply. 

aeries  -  Parallel  Events 


4.2  If  an  event  (Py)  has  a  probability  of  success  (pj)  and 
another  event  (P2)  has  a  probability  of  success  (pg)  and  the 
two  events  are  independent,  then  the  probability  that  on  any 
one  try  both  events  will  he  successful  in  the  product  p.p-.  If 
the  success  of  the  operation  depends  on  the  concurrent  success 
of  these  two  events,  the  events  are  in  series.  In  this  case, 
the  probability  of  success  of  the  operation  is  given  by 

p  =  PlP2.  But  if  the  successor  the  operation  depends  on  the 

success  of  either  or  both  of  the  events,  the  event3  are  in 
parallel.  The  procabili -y  of  success  of  the  operation  is  then 
given  byj  p«l  *-er*  and  q2  are  the  probabilities  of 

failure  or  the  events.  Since  qj=»l-p^  and  q2=l-p2,  the 
expression  in  terns  of  successes  tsa 

p=Pl+p2  -pjpj 

4.3  As  a  very  simple  example  cf  series  events,  assume  that 

the  successful  operation  of  a  fuze  de.-ends  ,r.  the  fir'ng  cf 
the  primer  and  arming  of  the  rote.  Jf  is  tits  probability 

that  the  primer  will  fire  and  p?  is  the  probability  that  the 
rotor  will  be  in  the  armed  position,  then  the  probability  thatt’n 
fuse  will  operate  la  p,p2.  If  we  assume  a  very  bad  esp.ssivo 
train  with  fi“  b.?  and  P2”v.7>  the  probability  that  the  tr»l.i 
will  operate  is  C.49. 
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4.4  Redundancy  tn  explosive  trains  can  be  used  to  illustrate 
parallel  events.  Assisi"  that  a  fuze  contains  two  identical 
pricers ,  either  -re  of  uhich  can  aatusoe  the  exrioMveSi  and 
that  these  pricers  eacr  rave  a  0.7  probability  cf  operating. 

The  probability  that  our  or  both  o'  tne  pricers  w*i.  operate 
is  C.7+0.7  -0.49=0.91  . 

Diagrams  of  Events 

4.5  The  examples  given  have  been  very  sicple.  In  situations 
the  events  can  teecco  quite  complex  and  cer.binaticns  of  series 
and  parallel  events  exist.  Graphic  representations  arc  used 
to  show  the  relations  and  sequences  of  cvfnts  in  the  situation. 
These  are  called  situation  diagrams.  The  very  siasle  diagrams 
of  two  events  in  scries  and  two  In  parallel  arc  given  by: 


parallel 


In  the  above  diagrams.  the  event  pj  h*s  the  probability  cf 
occurrence  Pj  and  the  event  P2  has  the  probability  of  occur¬ 
rence  Pj.  The  events  are  lndeper lent ;  l.e.  the  occurrence  cf 
pj  does  not  change  p2  etc.  An  cxacple  of  a  series-parallel 
combination  of  events  is  given  by: 


An  expression  for  the  probability  cf  success  mere  ‘-.le  events 
are  mutually  Independent  is  obtained  by  breaking  this  into 
parts,  blnce  Pj  and  P2  are  in  -dries  as  are  also  and  P_., 
and  Pj  and  Fg,  we  can  set  down  -  new  diagram 
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by  this  notation  F3F2  Is  an  event  forced  by  conblni..g  tha 
events  Pi  and  ?2  and  It  has  <»  probability  of  success  p3  pp. 
be*  PjPp  and  ?,P4  are  In  carallel  and  the  probability  of  success 
through  these  paths  Iss 

plp2+pip4  -plp2p3p4 

However,  this  Is  In  series  with  PcPg,  so  the  total  expression 
becceess 

(p.pa+p3p4  -e.p.p^)  pj  p6 


and  expanding! 

p=  P1P-2P5P6+  p3p4p5p6  *p1p2p3p4p5p6 

A  core  detailed  discussion  of  tha  sanlpulatlon  of  these  proba¬ 
bilities  is  given  in  Appendix  A  . 

Cross  Products 

4.6  It  was  noted  that  tha  expression  for  the  probability  of 
success  when  two  or  sore  events  are  parallel  contains  cross 
products.  If  and  are  parallel,  p  Is  given  bys 

P2  *P3  p. 

Hera  pjp2  Is  a  cross  product.  If  Pj,  P2»  and  P^  are  parallel, 
then 

P”P1+P2+P,  -PjP2  -pjP,  -P2P3+  P1P2P3 

Here  pjp2,  PiP3>  P2P3  end  PlP4p3  *r*  cr0,s  products.  Ihe 
significance  of  the  cross  products  say  best  be  explained  by 
using  the  simple  example  cf  two  parallel  events  In  which  the 
success  of  either  event  scans  the  success  or  the  operation. 

Ihe  expression  for  this  lss 

u-p.+p.  -?1p2 

the  probabilities  p^  and  p.  are  associated  with  c»ints  P3  and 
P2.  Since  success  depends  on  the  occur.er.  o  :f  P3  or  ?o  or 
both,  the  i.tuatlo.n  Is  represented  grarr.ice.ly  by  ?lg.  4-!. 
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t'cr  this  u.xample,  *e  can  imagine  that  the  area,  bounding  a-*-* 
r2  are  scaled  to  the  probabilities  p.  end  p~ ;  i.e. 

Ihe  total  area  encompassing  ?-]  and  ?2  the  probability  of 
success,  however,  it  alii  be  noted  tnat  the  area  obtained  by  ‘ 
adding  pj  or.d  p2  is  too  large  by  the  amount  pjp2.  *"e  cross 

product  ?jp2  appearing  In  the  expression  p=p,+  r2  Is 

therefore  a  correction  for  the  simultaneous  occurrence  cf  P> 
and  P2  which  Is  one  success  and  not  two.  It  Is  also  Inter¬ 
esting  to  note  that  when  events  must  occur  simultaneously  (cr 
In  series),  the  only  useful  area  Is  that  bounding  pjj^* 

Fig.  4-1  helps  to  illustrate  why  the  probability  of  success 
tends  to  decrease  when  the  number  of  series  events  increases. 

4.7  The  probability  of  success  Involving  three  events  rhere 
success  derends  on  the  occurrence  cf  any  cr  any  combination  of 
t.ie  events  Is  given  byi 

P*Pl+P2+P3  -p,p2  -F1P3  -PSP3+  PlPsFj- 
The  "plus  sign"  associate:!  ulth  P^P2P3  Is  not  immediately 

obvlcus,  but  Is  easily  explained  by  Fig.  4-2.  The  sun 
Pj+  P2+  P3  Includes  the  area- pjp2p^  three  t'nes.  The  three 
corrective  terns  p^Pg,  Pj?3»  and  P2P3  each  contain  PyP-^,  and 
since  they  arc  i  >biractei,  they  jffectirely  remove  the  area 
f1f2p3‘  Mt  slne9  th®  simultaneous  occurrence  r.f  the  events 
i-A,  P2  and  p,  is  a  success,  the  probability  PiP2P3  oust  be 
Included  —5  It  Js  therefore  added.  The  cross  product  terns  of 
four  or  core  parallel  events  can  be  analysed  In  a  slcllor 
■tanner. 

4.f  In  the  complicated  series  -  parallel  arrangements  of  events 
which  characterize  a  situation  dlagran  the  cress  project  terns 
become  very  difficult  to  handle.  Ihelr  Importance  is  evident 
when  the  orobatllltles  Involved  are  fairly  large,  as  In  the 
example  given  In  paragraph  4.4.  Eut  the  .SAP  Analysis  concerns 
safety  failures  and  accident  probability  and  therefore  deals 
»ltn  prccablllties  which  are  relatively  snail.  Fcr  exert 1c, 

U.e  oelssicn  cf  a  ro*cr,  arming  caused  ey  shocks,  primer’ 
ifnilico  by  static  electricity,  etc.  are  events  which  recur 
relatively  infrequently.  Probabilities  of  C.l  woull  be  3er-->- 
for  such  events.  Values  cf  C.01  or  C.Cvl  would  x.— .  -ear!., 
represent  the  expected  range,  '.hen  the  primary  v . 1  u  ,  arc  so 
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snail  the  cress  oreduetc  ieccr.e  exceed snail.  If  two  _« 
pcral Id  events  have  canal  probabilities  of  cecu-ring  of  ' C‘j 
fer  practical  purposes  'It  is  fust  a*  meaningful  to  srcul.  of  ti  e 
combined  probability  as  2  in  ICv  ratr.cr  t'-an  19°  Sr.  ’C,Cf.t. 

In  cost  cases  in  the  HAP  Analysis,  the  ere  :s  -.recocts  -sr  r- 
dropped.  If  this  were  not  'rue,  the  Rrn'”r-i s  as  presented  here 
sou id  bee ore  toe  involved  to  ce  practical.* 

a. 5  Ko  definite  rule  can  be  given  regarding  the  dropping  of 
cross  eroduct  tens.  In  general  it  is  desirable  to  neglect 
then  entirely  since  this  uaV.es  the  analysis  uuch  simpler, 
when  this  Is  dene,  the  final  answer  Mil  be  correct  if  it  «s 
rounded  off  before  the  cross  products  have  an  effect.  In  those 
cases  where  it  is  desirable  to  carry  figures  In  the  .-never  which 
are  of  the  sarte  nagnltude  as  cress  product  teres,  there  is  no 
alternative  tut  to  include  the  significant  cross  products.  This 
prcblee  will  be  discussed  further  in  Chapter  6. 

Syebols 

4.10  Since  the  diagrams  cay  contain  a  large  nueber  of  events, 
nomenclature  can  becoce  a  problea.  In  gases  or  experiments 
where  the  outccee  Is  classed  either  as  a  success  or  a  failure, 
it  has  been  customary  to  associate  "p“  with  the  probability  of 
success  and  "q"  with  the  probability  of  failure.  The  HAP 
Analysis  Is  concerned  with  safety  failures,  and  for  consistency 
it  eight  sets  reasonable  to  use  the  letter  %*  with  appro¬ 
priate  subscripts  tc  Identify  all  events  and  "q"  with  appro¬ 
priate  subscripts  to  lden*ify  ell  or.'-habilltles.  However,  It 
has  been  found  tnat  In  coapllcated  situations  the  subscripts 
ceeeue  unwieldy  and  offer  little  clue  to  the  nature  cf  the 
•vent  represented.  The  use  of  a  series  of  letters  has  proved 
core  satisfactory. 

4.1 1  in  a  situation  the  probability  cf  a  safety  failure  of  a 
device  is  determined  by> 

a.  Influences  of  environment 

b.  Characteristics  of  auxiliary  mechanises  and  gear 

c.  Tne  characteristics  cf  the  device  Itself 

*  The  accident  paths  in  different  situations  are  also  in 
r-.rollc!  rith  each  ether.  Pegleet  cf  cross  products  bet-  :er. 
situations  is  justifiable,  however,  because  if  the  mister  of 
accidents  In  .my  cne  situation  Is  large  encash  to  p-cduce  a 
significant  crocs  rroiuct  with  the  eccidcnt  rrotabil iilos  In 
another  situ-tlcn.  the  design  Is  so  unsafe  *!-at  it  rill  r.ave  to 
be  revised,  thus  saving  i  very  close  Bif  I  jc  value  cf  only 
academic  Interest. 
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In  general  the  environment  exerts  forces  on  the  device  or  -in 
the  auxiliary  gear  which  tend  tc  defeat  safety,  and  the 
resrop.se  of  the  device  and  auxiliary  cui  eei-eud  ur-css  their 
characteristics.  Sy  this  reasoning,  there  Is  a  logical  break' 
dovn  shleh  can  be  used  to  advant-ge  In  establishing  nomencla¬ 
ture.  Then,  by  definitions 

K  with  appropriate  subscript  will  denote  the  existence 
of  a  dangerous  mechanical  influence  (such  as  snook, 
crushing,  etc.) 

£  with  appropriate  subscript  w‘31  denote  the  existence  cf 
a  dangerous  electrical  Influence  (such  as  static  elec¬ 
tricity,  a F  fields,  poser  lines,  etc.) 

G  with  appropriate  subscript  will  denote  t)>e  existence  of 
a  miscellaneous  dangerous  Influence  (such  as  fire, 
cbeatcal,  etc.) 

4.12  Within  the  device  or  auxiliary  gear  a  safety  failure  will 
depend  on  the  fault,  failure,  or  emission  or  some  component 
and/or  the  proper  or  near-proper  functioning  cf  other  compo¬ 
nents.  Therefore  by  definitions 

P  with  appropriate  subscript  wls*.  denote  the  proper  or 
near-proper  functioning  of  a  component  In  the  device. 

(,  with  appropriate  subscript  wil1  denote  the  failure, 
fault  or  omission  of  a  component  in  the  device. 

3  with  appropriate  subscript  will  denote  the  proper  or 
near-proper  functioning  of  a  component  in  tho  auxiliary 
gear. 

S  with  appropriate  subscript  will  denote  the  fault,  fail¬ 
ure  or  omission  of  a  component  in  the  auxiliary  gear. 

One  additional  factor  which  wilt  n«»d  consideration  Is  timing. 
It  will  frequently  Mppen  that  certain  events  will  lead  to  a- 
accident  only  If  they  occur  in  a  particular  order  at  a  -ar¬ 
ticular  time.  This  frequently  decreases  the  chance  cf  an 
accident.  Then  by  definitions 

I  wltn  appropriate  subscript  will  denote  the  occurs  once  of 
a  necessary  order  or  ether  timing  of  events. 
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In  the  sense  intended  here  tirin';  *111  of  necessity  bectce  an 
event.  It  is  net  Intended  that  this  tiring  should  be  used  to 
adjust  varying  durations  of  situations  (such  as  10  years 
storage  as  opposed  tc  10  seconds  falling).  As  mentioned  in 
paragraph  2.4  the  duration  of  situations  is  considered  when 
probabilities  ere  assigned  to  the  event:  -r.i  is  not  a  simple 
multiplication  factor  since  the  environment  and  forces  Involved 
are  so  different  in  different  situations.  The  t lnlng  which  will 
appear  in  diagram  is  the  event  T  will  be  concerned  with  the 
order  of  events  or  with  a  restriction  on  tine  in  which  the 
•vent  aust  occur.  Por  example,  if  an  accident  can  occur  if 
event  A  Is  followed  by  event  E,  but  not  if  event  B  is 
followed  by  event  A,  than  the  only  accident  path  is  A 
followed  by  B.  This  order  la  in  itself  an  event.  By  In rr In¬ 
ducing  thla  event,  1,  tha  importance  of  the  order  is  recog- 
nlzed,  and  later  in  the  analysis  when  probability  values  are 
being  assigned  to  A  and  B  these  need  not  be  complicated  by  the 
necessary  order  of  events.  As  a  second  example,  if  event  A 
■ast  occur  daring  some  normal  function  of  the  device  (such  as 
during  tha  burning  tine  of  a  pyrotechnic  column)  the  restric¬ 
tion  on  tha  time  during  which  event  A  will  contribute  to  an 
accident  will  reduce  the  p:  ohabllity  of  an  accident  by  thl* 
mans.  Again  during  the  assignment  of  probabilities  It  will 
frequently  be  ouch  easier  tb  assign  a  probability  of 
occurrence  to  event  A  without  considering  the  effects  of  the 
tlae  restriction.  Tha  timing  Is  than  a  separate  series  event. 
Tbit  process  of  simplifying  events  is  discussed  further  in 
paragraph  4.15. 

4.13  To  the  events  E  mill  be  assigned  probabilities  of  occur¬ 
rence  n;  to  the  events  Z  sill  be  assigned  probabilities  of 
occurrence  a;  ate.  Upper  case  letters  represent  events  and 
lower  case  letters  represent  tha  probabilities  of  the 
occurrence  oT  these  events.  Ic  Illustrate  this,  the  path 
P204  representing  two  aeries  events  v«ll  have  a  probability 

P2V 

4.14  The  nomenclature  outlined  above  provides  the  advantage 
ttu.t  in  the  diagram  it  is  possible  to  tell  at  a  glance  if  the 
evnnt  occurs  outside  the  ordnance  system  or,  if  within, 
whether  it  la  in  the  device  itself  or  in  the  auxiliary  gear. 

The  symbols  are  such  easier  to  remember  because  the  sub— rlpts 
do  not  bee on 2  so  unvlsldly  and  tne  letter:  Immediately 
associate  theeselves  with  types  of  events. 
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4.15  The  ccEplexity  cf  a  diagroc:  drpaiids  to  a  greet  extent  on 
the  complexity  of  the  device  being  analyzed  and  the  desires 
of  the  analyst  in  reducing  events  to  staple  fora.  The  analyst 
plays  an  important  part  for  ho  ruse  balance  the  Inclusiveness 
of  his  event,  which  if  too  inclusive  rakes  probability  asst re¬ 
cent  very  difficult,  against  the  complexity  of  his  diagram. 

For  example,  If  the  analyst  defines  ky  as  the  event  that  in 
the  situation  shock  will  break  a  detent  which,  if  properly 
aligned,  will  fall  free  permitting  the  firing  pin  to  strike 
the  primer  which  fires  and  causes  flame  to  Impinge  on  the  lead 
because  the  rotor  Is  absent,  he  is  well  on  his  way  toward 
arrlwlng  at  a  very  cicala  diagram.  But  his  troubles  will  arise 
when  he  tries  to  assign  a  probability  *p.  If,  on  the  other 
hand,  he  defines  as  the  event  that  shock  will  break  the 
detent,  Pj  as  the  event  that  the  detent  Is  In  a  particular 
orientation,  as  the  event  that  the  rotor  sill  be  missing, 
and  P2  as  the  event  that  tha  primer  will  initiate  the  lees,  he 
is  going  to  have  a  more  complex  diagram  but  will  stand  a  good 
chance  of  having  figures  on  which  to  base  his  estimates  of  the 
probabilities.  In  general,  it  Is  preferablo  to  simplify  the 
individual  events  at  the  expense  of  complicating  the  diagram. 


4.16  It  is  felt  that  tne  steps  Involved  in  preparing  a  diagram 
ire  test  portrayed  by  the  use  of  an  example.  In  Charter  3  the 
electric  2ctb  Fuze  IX-2C0  was  described.  Cne  of  the  situations 
listed  was  'normal  drop"  (situation  "i").  A  diagram  for  this 
situation  appears  as  Fig.  *-3.  This  diagram  will  be  developed 
step  by  step  to  show  the  thought  Involved. 


4.17  To  reconstruct  the  situation  brierly,  we  are  concerned 
with  a  bomb  nixed  by  the  electric  Bomb  Fuze  aX-2GC  which  is  in 
the  act  of  being  cropped  on  a  target.  Although  it  is  true 
that  the  bomb  nay  drop  from  an  internal  nek  through  bor.b  bay 
doors  or  nay  drop  from  an  external  rack,  those  art  considered 
sufficiently  similar  to  be  included  in  a  single  situation. 

The  act  of  releasing  the  bomb  recoves  all  safety  provided  in 
the  release  gear;  l.e.  the  switches  which  prevent  charges  free 
getting  into  the  fuze  are  rurpocaly  closed.  A  charge  !a  pul 
on  the  condensers  in  the  fuze  and  the  erc’ng  cycle  is  autccotj- 
olly  set  In  notion.  Free  the  instant  rf  release  until  s.se 
safr  seraratton  of  bozb  and  'Tuns  is  realized,  the  plane  is 
in  danger  of  being  destroyed  or  daraged  if  a  crenT'ure 
explosion  3h.culd  cc'ur. 
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lfi  Pros  the  Instant  of  release,  the  tine  to  complete  erring 
depones  uron  ryrotechnlc  sr.d  >C  delays  in  the  fuze  and  ho* 
these  night  have  teen  affected  by  rrevtrai-;  environments.  The 
fare  so  cones  i-i  ogress  iveiy  core  dangerous  or  snore  likely  and 
capable  of  being  Initiated  as  a  function  i.f  t Ire.  Cn  the 
other  hand,  the  airplane  's  less  IJJc’y  to  te  destroyed  or 
damaged  as  the  distance  between  tesb  and  plane  Increases. 

This  Jlstance  Is  a  function  of  tlce.  It  Is  necessary  to 
strike  an  average  sor.e»here  In  the  tlce  er  space  when  the 
plans  Is  In  danger.  This  Is  done  by  the  choice  of  severity 
factor,  l.e.  the  cost  of  the  accident  Is  taken  as  soce 
fraction  of  the  value  of  the  airplane. 

4.19  In  the  lnte-val  during  which  the  tor.b  Is  el  thin  lethal 
range,  what  coal..  go  wrong?  that  events  oeuld  cause  a  pre¬ 
mature  boab  burst?  The  answers  to  these  questions  rill  be 
found  in  the  accident  paths.  The  accident  paths  will  ccsrlr.c 
to  fora  a  dlegran  and  ‘from  the  diagram  a  relative  accident 
probability  or  probability  factor  can  be  obtained. 

4.20  In  the  description  of  the  operation  of  the  fuze  It  was 
noted  that: (a)  charging  Is  accomplished  through  the  bridge  wire 
of  a  2  second  actuator  thus  Initiating  It,  (bj  the  2  second 
actuator  operates  several  switche-,  one  of  which  supclles 
energy  to  the  4-1/2  second  actuator,  and  (c)  the  4-1/2  second 
actuator  turns  the  rotor,  thus  eecoleting  the  arcing  of  the 
fuze.  Cn  the  average,  6-1/2  seconds  is  considered  to  be 
sufficient  time  for  the  boob  to  fall  to  a  safe  distance,  and 
therefore  situation  "l"  is  defined  as  existing  for  (.-1/2 
seconds  froa  the  instant  of  boub  release.  In  the  physical 
description  It  was  pointed  cut  licit  the  pricers  and  actuators 
are  located  In  a  plastic  section  which  also  houses  th/  elec¬ 
tronic  ccnrcncnts.  The  rotor  is  In  r.  casting  which  fits  helot 
the  plastic  section,  let  us  arv—  c  that  In  operating,  the 

2  second  actuator  develops  too  such  -ressure  and  ruptures  the 
copper  bellows  and  that  the  hot  gases  thus  released  initiate  a 
nearby  pricer.  This  event  we  will  call  r2-  let  us  further 
assuce  that  the  4-1/2  second  actuator  was  initiated  spuriously 
at  scce  earlier  tl.-e  and  was  able  to  effect  rotor  arsing 
because  the  rotor  lock  shaft  was  short  or  missing.  These  events 
will  be  called  O4  and  yi2-  The  three  events  in  scries  will 
mean  an  arcUent.  Sehcs—tlcally,  this  accident  cath  l'.fcs  like 
this: 
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4.21  At  first  glance  this  accident  path  appears  to  be  far¬ 
fetched.  There  Is  gecd  likelihood  thr*  It  Is,  but  this  Is 
something  that  will  cone  rase  when  siros-bllity  values  are 
assigned  to  the  events  and  compared  to  other"  paths.  la  set  tin 
iu  accident  oaths  for  a  situation  dlacraa,  it  i 


»ltr.  the  further  consideration  that  a  safety  failure  rate  of 
not  score  than  one  in  cne  million  is  a  goal  in  fuze  design,  it 
becomes  evident  that  an  accident  nay  be  In  Itself  very 
improbable.  If  this  goal  is  to  be  realistic,  a  lot  of  individ¬ 
ual  paths  containing  a  lot  of  cresy  combinations  of  events  will 
have  to  be  considered  seriously.  Therefore  the  path  which  Is 
a  "most  unfortunate"  combination  of  "highly  improbable"  evoncs 
cist  not  be  Ignored;  added  to  many  "-ore  like  it,  it  contrib¬ 
utes  Its  bit  to  an  accident  probability  cf  real  proportions. 

4.22  Our  first  event  P2,  resulted  In  the  firing  of  a  primer. 
With  the  primer  firing,  there  are  vays  besides  the  previous 
actuation  of  the  4-1/2  second  actuator  in  vhich  the  fuze  safety 
could  be  defeated.  If  the  rotor  had  never  been  installed 
(event  the  prltser  would  fire  directly  at  a  lead.  The 
firing  of  the  lead  by  the  primer  se  will  call  r,Q.  The  tvo 
paths  combined  look  like  thlss 
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Obviously  there  ere  other  vays  in  which  the  safety  supplied 
by  the  rotor  could  be  defeated.  Ihe  primer  could  fire  the 
lead  directly  even  with  the  rotor  In  the  unarmed  position 
(rgj,  or  the  primer  could  fire  the  detonator  in  the  unarmed 
rotor  (Pc)  and  this  could  fire  the  lead  ifg).  It  .s  posslbl" 
that  rough  treat-unit  and  ijmdling  ecu  Id  have  broken  the  shear 
sire  Permitting  the  rotor  to  turn  to  the  armed  position  (If.) 

or  that  the  shear  wire  was  never  present  and  the  rotor  worked 
Itself  Into  the  arced  position  (!,y).  Combining  all  of  these 

gives  the  following  portion  cf  the  final  diagrams 
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4.23  All  the  paths  whlcn  have  been  listed  so  far  hav?  started 
with  the  event  Po  that  the -2  second  actuator  breaks  it  confine¬ 
ment  and  Initiates  a  primer.  There  are  other  ways  In  shicfc 
the  primers  can  he  Initiated,  The  priners  have  high  electrical 
sensitivity,  and  although  the  fuse  circuit  is  designed  to 
Isolate  the  primers  and  numerous  electrical  checks  are  made 
curing  assembly  to  preclude  airing  errors,  there  is  still  a 
possibility  that  bad  airing  was  missed  cr  that  subsequent 
treatment  Induced  a  fault  vhlch  would  permit  the  charging 
current  to  flro  a  primer.  These  and  other  considerations, 
such  as  shock,  it.  F.  Induced  current,  etc.  arc  Included  in  the 
event  Cj  that  the  pricer  is  actuated  spuriously.  Since  the 
event  Ci  associates  with  priwer  f4rlng,  it  mill  ho  followed  by 
the  events  previously  presented  involving  defeat  cf  the  safety 
provided  hy  the  rotor.  As  a  second  part  of  the  diagran,  oe 
have* 


•.he  result  cf  a  continuation  of  this  rrccc.it  is  ,-ivnn  in 
Fig.  4-s.  The  events  arncarlng  in  this  f’.mrc  sr*-  *ncd  In 
Table  4.1. 
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4.24  uvents  having  probabilities  which  are  nearly  e;,us]  tc 
1.0  arc  raitt-d  frets  diagrams.  In  ccr’-inctlcn  with  tke  ran;, 
scan  probabilities  of  events  which  usually  eafce  up  a  path,' 
these  large  probabilities  nave  very  little  effect  on  the  value 
of  the  final  snarer.  Furthermore,  since  In  cost  cases  the  bases 
for  est  1  nates  of  values  arc  not  ge'd  enrsgb  to  'V'se  departure 
free  the  Use  of  a  dec, dal  system,  values  such  as  0.6,  0.9  etc. 
would  generally  be  carried  at  1.0  and  *111  not  change  the  path 
value.  For  example,  In  Fig.  4-3,  ?2  Is  the  event  that  the 
2  second  actuator  Initiates  a  pricer.  Although  this  event  Is 
considered  as  the  start  of  the  path,  there  are  certain  things 
which  cust  occur  before  the  actuator  fires.  Switches  must 
close;  power  cust  be  available.  Hone  of  these  are  certainties 
Cl.e.  probability  e<;ual  to  1.0),  but  since  they  are  Involves 
In  normal  functioning,  these  probabilities  are  probably  of  the 
order  of  C.9  or  better.  Because  these  events  have  so  little 
effect  on  the  path  answer,  they  are  ccltted  or  tacitly 
Included  In  other  events,  thus  simplifying  the  dlagraz. 

4.24  It  will  be  noted  that  In  Fig.  4-4  there  ara  nusercus 
duplications  of  events.  For  example,  l*g,  Qy,  Fy.  (9,  Ci ,  Cc, 
and  7jo  appear  four  times;  and  ^g  appear  three  tlces, 

etc.  In  the  final  diagram,  It  Is  desirable  to  have  no 
duplications,  for  an  event  Is  discrete.  Furthermore,  dupli¬ 
cations  tend  to  Increase  the  difficulty  of  determining  the 
valla  cross  products  ahlch  apply  to  correct  th»  answer  obtained. 
However,  the  preparation  cf  a  work  sicet,  such  as  Fig.  4-4 
with  its  nusercus  duplications,  *s  a  cccx-ended  step  In  the 
preparation  of  a  diagram. 

4,26  Experience  has  proved  that  the  following  steps  are  test 
suited  to  the  orderly  preparation  of  a  situation  diagram. 

a.  Step  1.  Accident  Paths.  The  first  xter  in  the  prepa¬ 
ration  of  a  diagram  Is  to  set  down  Individual  accident  paths. 

At  this  tlire  it  Is  wise  to  disregard  duplication  which  Is 
occurring  so  that  full  attention  can  be  directed  tc  *ne  nature 
cf  the  events  and  the  factors  ahlch  affect  thee.  At  no  other 
time  Is  the  device  Itself  under  greater  scrutlu),  It  Is 
pictured  In  the  light  of  experience,  aided  by  lnavlnui;cn,  In  a 
situation  and  the  events  which  could  lead  to  accidents  ere  set 
aoar.  as  they  cere  to  rind.  The  result  is  a  word  sheet  some¬ 
thing  lire  Fig.  4-4  At  this  time  any  concern  regarding  the 
final  appearance  of  the  diagram  is  apt  to  detract  from  ti« 
thought  with  which  each  path  Is  considered  and  reduce  the  csrc 
exercised  in  exploring  all  possible  avenues. 


3: 

Cf  KF  it1—.!  IAL 


'-csfislhtia: 

j.AVCr.D  ZZVZttt  41*; 


fc.  Step  2.  Systematic  Ccr.bininc.  Step  1  miy  result  in 
little  sjSwCm  or  order  in  the  -.ay  the  accident  -at ho  are- 
listed.  wtec-  2  i 3  purely  wich*nic*il  and  Involve*  o-dp’-lng 
and  combining  paths  tc  reduce  duplication  and  the  size  of  the 
diagram,  it  a  ill  usually  te  feu no  that  cnc  initial  evert 
will  lead  into  a  number  of  o*har  event-  so  that  the  paths 
tend  to  branch.  This  is  illustrated  in  Fig.  4-4  she re  the 
initial  events  are  not  repeated,  as  they  well  night  be  lr.  a 
first  work  sheet.  y.encvin?  duplication  in  initial  events  Is 
actually  a  part  of  step  2,  cut  usually  so  sir.rle  that  it  is 
done  in  step  1  without  causing  any  distraction,  denovlng 
duplication ‘In  later  events  in  the  accident  path  chain  requires 
a  little  more  manipulation.  Figs.  4-5  and  4-6  illustrate 
stages  in  the  process  of  combining  paths.  It  will  be  noticed 
that  many  duplications  have  been  removed  in  Fig.  4-6  and  that 
only  Cj  and  0^  are  duplicated  in  Fig.  4-3  which  is 

considered  one  of  the  simplest  oractical  diagrams  for  this 
situation. 

c.  Step  3*  Assessing  Duplication.  It  Is  often  difficult 
to  remove  all  duplications  of  events  arid  come  up  with  a 
diagram  which  is  easy  to  follow.  In  Fig*  4-3  durlicatlcn  has 
been  permitted  to  remain  because  removal  would  require  compli¬ 
cated  creasing  lin-s  and  otherwise  modifying  existing  rules 
Cwhich  will  be  discussed  later},  bunllcation  is  undesirable 
because  in  the  full  expansion  of  the  terns  it  will  introduce 
tents  which  arc  incorrect  and,  in  the  rigorous  sense,  non¬ 
existent.  However,  in  the  practical  use  cf  the  HAP  Analysis 
it  is  quite  unlikely  that  these  terns  will  affect  the  usable 
part  of  the  probability  factor.  In  the  event  there  is  a 
question,  it  is  always  ty»*«ible  to  urltc  down  the  terms  and 
determine  where  the  Incorrect  products  affect  the  answer. 

Guides  to  writinv  cross  product  ter^s  will  be  found  in 
Appendix  A. 

4.27  When  duplication  is  alleged  to  remain,  it  is  advisable 
to  note  tnis  cn  the  diagram  as  done  on  Fir.  4-3.  This  mskes 
the  problem  of  picking  cut  appropriate  cress  products 
considerably  easier.  In  the  more  ccnrllcatcd  diagrams  a 
reasonable  acrunt  of  hr«dginc  cf  lines  will  net  remove  all 
duplication.  The  b-lar.ce  between  optimum  trier  ln<r  and 
duplxcatloii  t»  d  balUr  of  ^augment.  Too  nuen  crMrir».w  "aVes 
the  diagram  extremely  hard  to  fellow.  Too  such  curl icat ion 
leads  te  inaccuracies  in  the  study  of  cros>  oredu ;T  effects. 

4. 2c  It  will  te  no*ed  that  si l  t.nc  l*nes  *-'«n1nr  different 
l-vels  In  tl.e  diagram  cf  Fig.  4-3  arc  slf*.xt  •/  These  sta-tinf 
lines  serve  ?  rarticuTar  runoae.  7V  y  ..-.re  /nidirer*  icn" 
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frcr.  left  to  right.  In  following  mn  acctden-  -nth  *t  tr 
-err.!  settle  to  enter  a  slanting  line  -reviled  this  line  s'.'.'l 
give*  cot  Ion  to  the  right,  this  Is  Illustrated  ir.  Fig.  a-3 
•••here  co  note  that  the  path  r7t,  sacifles  the  rci.ulrerer.* , 
but  the  cat!:  F.C.  would  —•.■lire  revere ir.r  d'rrcticn  on  a 
slanting  line,  neferring  to  Fig.  4-4  rt  see  that  Pgi •  Is  a 
valla  ,«*h,  but  rgO 4.  Is  not.  If  the  line  joining  these  t.-.o 
portions  of  the  diagram  had  been  draan  vertically,  there  could 
be  no  cay  to  cake  this  distinction. 

4.29  The  events  shich  r-al.e  up  a  situation  diagram.  are  usually 
a  mixture  of  independent  events  and  nutualiy  exclusive  events. 
Independent  events  are  those  shich  can  occur  independent!,,  of 
any  other  events.  One  Independent  event  does  n-t  oreclv.de 
another;  the  two  can  co-extst.  For  cxanplt,  In  Fig.  4-3, 

F3  and  £4  are  Independent  for  all  practical  purposes.  The 
actuation  cf  a  orleer  by  the  actuator  is  considered  to  Le 
completely  Independent  of  the  closure  cf  the  reei  switch.  These 
Independent  events  give  rise  to  cross  products.  The  product 

exists.  Ilatually  exclusive  events  are  events  which  cannct 
co— exist;  one  event  precludes  the  other.  In  Fig.  4-3  and 
Fg  ere  cutually  exclusive  events,  i.e.  the  event  that  the 
pricer  fires  a  lead  with  the  rotor  in  the  safe  position  do-s 
not  exist  If  the  rotor  was  newer  Installed,  ->1nce  the  cross 
product  is  a  correction  for  the  sismltar.ecus  occurrence  of 
events  (paragraph  4.6),  mutually  exclusive  events  do  net  r..-ve 
cross  products.  However,  there  is  a  factor  linking  the 
mutually  exclusive  events.  If  we  consider  the  probability  that 
the  rotor  is  absent  and  the  probability  that  the  rotor  is 
present,  it  is  apparent  that  these  two  rust  edd  to  1.0.  In 
assigning  probability  values  to  the  events  In  Fig.  4-3,  it 
should  be  realized  that  the  value  of  pc  shci'td  be  cultiplic:  by 
l-qj  to  correct  for  those  tines  when  the  rotor  is  absent.  Set 
the  value  of  1-qg  is  0.99  (Fig.  6-1)  and  it  contributes  nothl-g 
to  the  answer.  It  will  usually  be  found  that  this  factor  can 
be  oeitted  because  it  is  too  great  a  rertnecenc  fer  the  systes 

4.30  In  practice  the  demarcation  between  Independent  events 
and  mutually  exclusive  events  is  usually  not  very  clear.  In 
the  example  given  in  the  last  paragraph,  it  could  be  erf-el 
that  the  firing  of  a  pricer  sight  create  dlst-rbunres  -hich 
could  Influence  the  closure  of  tk»  red  switch  s->-  -vus  the 
tve  sculd  r.ct  be  truly  independent.  In  general,  '1  . . .  I  or. 
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diagrams  do  not  atterrt  to  extinguish  between  ind-j  cedent 
events  and  ruiaally  exclusive  events.*  1*  ^ss  been  lYund  r. ore 
profitable  lo  consider  these  rrofcier.s  ~hen  t.ne  effects  of  tne 
larger  c^nss  products  are  bt !ng  assessed.  This  *111  be  c;s- 
ci:sscd  in  detail  in  Chapter 

4.31  in  summary,  the  situation  diagram  is  a  graphic  presenta¬ 
tion  of  the  accident  paths  30  arranged  that  individual  paths 
are  clearly  discernible  ar.d  the  relations  of  paths  to  each 
other  are  depleted.  It  is  a  cap  rf  the  routes  through  si.ich 
safety  can  fcc  defeated  '-here  each  event  is  identified  by  a 
syctol  having  an  assigned  probability  value. 


•  in  very  sisplc  diagrams  a  sysbology  has  been  used  to 
note  the  difference  between  independent  and  mutually  exclusive 
events,  this  is  illustrated  by  thf  following:  example. 


A  and  2  arc  cutually  exclusive,  and  tc  signify  this  »at**s 

arc  joined  by  vertical  lines,  r’erctsslllc  sotiec  on  the 
vertical  lines  «<s  indented  by  arrets.  C  and  b  art  also 
mutually  exclusive.  T?:e  equation  fer  thi«s  sicr’.e  niagrax  is 
(a  +  b)  tc+d).  In  this  scher.e  events  **■  are  ir.d^t  «*n  Knt 
*nv3d  to  joinrd  in  the  noma  I  carter  by  slanting  lines. 
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Situation  "1"  -  iiernal  Lrcp  Kroc 
ho~b  release  to  Safe  reparation 

1 _ Event  Definition _ 

Hough  handling  cechanlcaliy  arcs  rotor. 

50  xs  or  instantaneous  cricer  actuated  spuriously. 

4-1/2  sec.  actuator  (Ag)  spuriously  Initiated. 

A  detonator  is  spuriously  Initiated. 

2  sec.  actuator  (Aj)  Initiates  a  pricer. 

4-1/2  sec.  actuator  (Ag)  Initiates  a  prlaer. 

Priser  fires  dainn-tar  -  rotor  in  safe  position. 

2  sec.  actuator  (Ay)  fires  a  detonator. 

4-1/2  sec.  actuator  (Ag)  fires  a  detonator. 

frlxer  fires  a  lead-rotcr  In  safe  pcsltlcn. 

A  detonator  fires  a  lead -rotor  In  safe  position. 

Pricer  fires  a  lead-rotor  absent. 

2  sec.  actuator  (Ai)  fires  a  lead. 

4-1/2  sec.  actuator  (Ag)  fires  a  lead. 

4-1/2  see.  actuator  (Ag )  fires  iead-rotor  absent. 

2  sec.  actuator  (A^)  gives  very  short  or  \c  delay. 

Heed  switch  In  fast  pricer  circuit  (n-c-ij  is 
closed  or  closes. 

Rotor  arcs  because  of  closing  shear-slrc. 

Hotor  *s  nlsslng  inever  Installed). 
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TABLE  t  1  (Ccr.t'd) 

Event  Eyctol _ Event  Definition _ 

<*11 

<*12 

J8 

To 


*10 
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4-1/2  sec.  a*.tu*tor  (A?}  r'^ss  very  short  or  no 
delay* 

rfotor  lockshaft  short  or  nlssln/* 

The  transforn  which  corrects  for  the  rrccatiilty 
values  of  Cl,  C5»  and  ^4  *h*ch  are  based  uro:i 
6-1/2  seconds  (the  tine  In  which  a  preset  tu  re  Is 
considered  dangerous)  to  cocrurafclc  values  for 
2  seconds*  The  transforn  T£  ..c counts  for  the 
fact  that  A2  has  a  nornal  delay  of  4-1/2  seconds 
leaving  2  seconds  for  accident* 

The  transforn  which  corrects  for  the  probability 
values  of  Ci,  O5,  and  G4,  which  are  based  upon 
6-1/2  seconds  to  ccsparacle  values  for  4-1/2 
seconds*  The  transform  T9  accounts  for  the  fact 
that  ai  has  a  norcal  delay  of  2  seconds  leaving 
4-1/2  seconds  for  accident. 

*2  eras  rotcr  before  firing  pricer  or  detonator. 
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FIG.  4-4  CONTINUED 
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FIG.  4-5  PREPARING  A  DIGRAM 
STEP  2  ELEMENTARY 
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PROBABILITY  A3J.IGM.1iKT 

5.1  Having  obtained  in  the  diagram  a  graphic  picture  of  the 
routes  and  events  which  will  lead  to  accidents,  u.ic  next  ma.ior 
step  in  the  analysis  is  to  assign  numerical  values' to  the 
probabilities  of  occurrence  of  these  events.  Cfr-hand,  this 
woulu  appear  to  he  a  difficult  task.  This,  however,  is  not  the 
case  if  the  persons  making  the  assignment  have  a  general, 
practical  knowledge  of  ordnance  and  of  the  "situation"  under 
consideration  and  will  earnestly  seek  knowledge  obtainable 
from  the  experience  of  others  in  service  use  of  similar  items 
under  related  conditions.  Also  many  quantitative  values  ca.i 

be  obtained  directly  from  test  results  of  the  device  under 
consideration  or  of  similar  devices.  Only  in  part  of  the  cases 
will  it  be  necessary  to  arbitrarily  assign  values. 

Arbitrary  Assignments 

5.2  It  is  realized  that  in  arbitary  assignments ,  it  is  unlikely 
that  two  people  would  assign  ♦he  same  probability  of  occurrence 
to  a  specific  event.  In  the  final  results,  which  are  generally 
used  only  in  the  relative  sense,  this  may  make  very  little,  if 
any,  difference  if  the  individual  values  are  selected  on  a 
comparative  basis  and  consistency  is  maintained  through  cross¬ 
checking  of  related  events.  If  more  than  one  person  is 
assigning  probability  values  to  the  various  situations,  it  is 
advisable  that  those  persons  as  a  group  review  the  values  for 
all  the  situations  so  that  the  assigned  values  for  each  of  the 
situations  and  events  are  made  cn  the  same  basis  or  from  a 
common  reference  point.  Sources  of  information  which  may  be 
useful  in  assigning  probability  values  are;  QC  reports  on 
similar  service  ordnance;  statistical  data  from  fleet  oper¬ 
ations;  test  and  evaluation  data;  and  Acceptance  Quality  Level 
assignments  stated  in  the  design  disclosure  documents  governing 
manufacture). 

5.3  In  assigning  a  numerical  value  to  the  probability  cf  the 
occurrence  of  an  event,  it  3s  desirable  to  use  a  decadal 
system.  That  is,  the  probability  is  set  ecual  to  1  x  10“  , 
where  the  exponent,  an  integer,  is  the  number  to  be  assigned. 
This  method  has  several  advantages.  It  Is  relatively  easy  to 
decide  or  determine  if  a  probability  Is  nearer  to  nn*  occur¬ 
rence  in  10  (10"1),  or  1  In  100  (10  or  1  in  10C0  (10“^>), 
etc.,  while  In  most  cases  it  would  be  difficult,  in  r.  pre¬ 
liminary  analysis,  to  assign  values  ..  ith  an  accurac;  •  ~  B>)ter 
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than  a  factor  of  ten.  Also,  if  the  diagrams  arc-  complicated 
and  lengthy  and  there  are  a  '.urge  number  of  situations,  the 
computations  uecome  much  simpler  with  such  a  system.  After 
the  analyst  Jj  completed,  it  is  known  which  values  arc 
critical  in  respect  to  the  overall  answer.  Then  these  values 
may  be  examined  more  closely  and  a  more  accurate  figure  may  te 
obtained  through  further  investigation,  or  as  a  result  of  an 
evaluation  program  or  from  other  additional  data  which  may  be 
obtained  by  increased  effort. 

Systematic  Scheme  of  Assignment. 

5*4  In  order  to  assign  values  which  are  as  realistic  as  pos¬ 
sible,  it  is  necessary  that  it  be  done  in  a  systematic  manner. 
Since  the  various  events  have  been  broken  down  into  groups 
(see  para.  4.11  and  4.12),  it  is  desirable  to  assign  probability 
values  by  groups  rather  than  to  individual  events  encountered 
in  a  situation  diagram  without  regard  to  similar  events 
occurring  in  other  situations.  This  means  that  it  is  highly 
desirable  that  all  of  the  diagrams  be  completed  before  an 
attempt  to  assign  any  probability  values  is  made;  the  advan¬ 
tages  can  readily  be  seen  as  values  are  assigned  in  the  example. 
On  the  other  hand,  no  attempt  should  be  made  to  guess  In  advance 
which  values  are  going  to  turn  out  to  be  the  critical  ones,  as 
*  this  would  probably  affect  and  bias  the  accuracy  of  tKV  analysis. 

5.5  While  it  is  best  to  assign  the  probability  to  an  event  lr. 
all  situations  at  one  time,  it  should  be  noted  that  the  proba¬ 
bility  of  occurrence  ma.,  cr  may  not  bo  the  same  for  the  same 
event  in  the  various  situations.  It  so  happens  that  Cj  has  six 

different  values  throughout  the  situations  of  the  example  fuze 
while  (iy  has  only  one  value.  This  is  logical  since  0^,  which 

is  the  spurious  actuation  of  tho  50  ms  or  instantaneous  primer, 
is  highly  dependent  upon  the  environment  which  frequently  makes 
different  situations.  On  the  other  hand,  which  is  the  event 

that  a  missing  shear  wire  allows  the  rotor  to  arm,  is  the  result 
of  an  assembly  error  and  has  little,  If  any,  dependence  upon  the* 
environment  existing  in  a  situation.  Other  events,  such  as  O7, 

which  is  the  accidental  pushing  of  the  bomb  release  button, 
may  occur  in  a  very  few  of  the  situations  (3  in  this  an* lysis). 

Example  Probability  Values 

5.6  The  assigning  cf  values  may  best  be  described  by  an  actual 
illustration.  For  this  step  In  the  analys  * -* .  a  work  sheet  like 
Table  5.1  may  be  used;  the  various  situations  *re  listed  scroas 
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the  top  and  the  events  down  the  loft  side.  It  is  advantageous 
to  have  the  work  sheet  ccr.rlotc  with  all  the  events  listed. 

This  makes  it  much  easier  to  cross-check  the  probability  values 
as  they  are  assigned.  For  this  example,  we  will  work  with  the 
yroup  of  events  designated  by  the  symbol  0.  There  are  five  of 
these  events  as  shown  in  Table  5.1.  In  the  fii-A,t  event,  0^, 

tspuricus  initiation  of  50  ms  or  instantaneous  primer)  in 
situation  "a",  (assembly,  packaging,  storage,  handling,  and 
transportation  outside  of  ordnance  -  this  includes  ali 
situations  before  the  bomb  and  fuze  are  associated,  from  loading 
plant  to  ship's  magazine,  to  unpacking  just  prior  to  fuzing)  we 
will  assign  to  x  a  value  of  3*  This  means  the  probability  of 
0^  occurring  is  one  in  1000  (1/1000).  At  first  thought,  this 

value  of  x  may  seem  very  large,  but  it  must  be  remembered  that 
this  situation  may  cover  a  lot  of  time  and  "ground"  -  from 
loading  plant  to  use. 

5.7  For  the  most  part  this  assignment  was  arbitrary,  but  there 
were  some  facts  which  could  act  as  guides  in  getting  the  proba¬ 
bility  into  the  right  order  of  magnitude.  The  most  sensitive 
wire-bridge  primer  which  has  been  produced  in  large  numbers  is 
in  the  class  known  familiarly  as  the  f)D-24.  Total  production 
of  this  class  of  primer  for  fuze  and  other  uses  runs  well  Into 
the  millions.  The  history  of  use  of  this  primer  Is  spotted 

by  unintentional  actuations,  some  of  known-  but  many  of  unknown 
causes.  Although  the  records  do  not  lend  themselves  to  easy 
determination  of  the  rate  of  accidents  in  fuze  assembly  and 
handling  It  must  be  assumed  that  these  operations  had  their 
share,  because  of  the  fact  that  numerous  stories  of  spurious 
actuations  of  the  ND-24  primers  had  come  to  light,  it  was  felt 
that  the  rate  must  be  somewhere  between  1C”4  and  10~?.  in  the 
face  of  the  stories  and  reports,  it  did  not  seem  reasonable  to 
assume  that,  on  the  average,  more  than  100, COC  of  these  primer 
could  be  assembled  into  fuzes  without  at  least  one  accident. 

The  primers  used  in  the  Bomb  Fuze  EX-2C0  -re  about  20  times 
mere  sensitive  to  capacitor  discharge  than  the  ND-24  and  about 
twice  as  sensitive  to  direct  current  initiation.  .Tt  must  be 
assumed  that  these  primers  would  be  involved  in  an  even  greate: 
number  of  Incidents.  For  this  reason,  the  value  of  10”J  was 
assigned  as  the  probability  that  the  instantaneous  or  50  ms 
primer  would  be  spuriously  initiated. 

5.8  In  the  se-ond  svent,  0^*  the  same  value  (3)  is  assigned 

since  this  primer  Is  similar  to  the  other  two  and  has  the  seme 
sensitivity.  In  the  third  event,  O3,  the  actuator  is  more 

sensitive  or  more  susceptible  to  3purious  initiate  than  the 
primers;  therefore  1  value  of  2  is  assigned  tc  x  (1,100).  In 
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O4  the  value  is  the  same  as  C3  since  the  sensitivity  of  the 

actuators  is  the  same.  In  05,  since  the  detonator  is  net  as 

sensitive  or  susceptible  to  snurious  initiation  os  the 

actuators  or  the  primers,  a  value  of  4  is  assigned  to  x.  This 

and  the  preceding  paragraph  have  illustrated  the  process  cf  (a) 
determining  with  the  best  information  available  a  reasonable 
value  for  the  occurrence  of  a  key  event,  and  (b)  using  this 
key  event  as  an  anchor  point  reconciling  the  values  assigned 
as  the  probabilities  of  other  related  events. 

5.9  Now  we  are  ready  to  assign  values  for  the  next  situation 
■which  is  Fuzing  -  inserting  the  fuze  in  the  bomb.  This 
situation  differs  from  situation  "a"  in  that  the  time  required 
to  remove  a  fuze  from  its  container  and  to  place  it  in  the  fuze 
well  of  the  bomb  is  only  a  matter  of  minutes  for  a  normal 
operation.  Thus,  any  occurrences  which  depend  on  time  will  bo 
minimized.  Also,  a  fuze  which  has  been  removed  from  its 
shipping  container  will  be  handled  more  carefully  than  one  in 
the  container.  The  following  values  will  be  assigned:  6  for 
Ci,  and  02»  4  for  O3  and  O4  and  7  for  O5.  Situation  "c"  is 

concerned  with  defuzing  of  the  bomb  for  any  reason.  The 
probability  values  for  the  various  events  in  this  group  are 
considered  to  be  the  same  as  for  situation  "b".  In  situation 
"d"  (handling  of  the  fuzed  bomb),  the  handling  of  a  fuzed  bomb 
will  be  even  more  careful  than  the  handling  of  a  fuze;  the  fuze 
Is  more  protected  and  it  is  less  likely  that  the  fuzed  bomb  will 
be  dropped;  therefore,  higher  values  will  be  assigned  to  x  for 
the  events  in  this  situation.  The  assignment  of  numerical 
values  for  the  events  of  other  situations  is  done  in  a  similar 
manner. 

5.10  For  events  such  as  qv  (missing  shear  wire  permits  rotor 

to  be  in  armed  position  prior  to  operation  cf  arming  actuator) 
which  are  a  function  of  the  initial  assembly  cf  the  fuze,  the 
value  will  logically  (at  least  as  a  first  approximation)  be 
the  same  for  all  situations  considered.  This  probability  is 
typical  of  many  in  that  it  can  be  further  broken  down  into  two 
series  probabilities.  Cne  is  that  the  -wire  is  missing  (from 
omission  in  manufacture  In  this  case,  since  the  design  of  this 
fuze  is  such  that  it  will  not  fall  out  once  it  ts  in  place) 
and  the  second  is  that  at  any  particular  time  the  unrestrained 
rotor  may  be  in  such  an  angular  orientation  that  it  will  permit 
fire-through.  In  the  assembly  of  the  fuze  the  absence  01  the 
shear  wire  would,  under  rules  presently  1r.  effect,  bo  con¬ 
sidered  a  critical  defect,  and  therefore  the  inspection  cf  this 
part  would  ho  more  thorough  than  for  some  other  part  rf  the  fuzek 
Also,  the  method  of  rotor  assembly  gives  assurance  that 

the  shear  wire  is  not  missing,  m do ..-stimates  cf  the 
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frequency  of  a  missing  shear  wire  auri. g  manufacture  ha\e 
ranged  from  1/2000  to  1/1CQCC.  For  this  example  we  v. ill  say 
1/4000  (1/4  x  10"-*),  which  seems  quite  realistic.  The  rotor 
serves  as  the  interrupter  for  the  explosive  train  and  during 
the  arming  period  it  rotates  90  degrees  from  tv,r-  unarmed 
position  to  the  fully  armed  position.  However,  the  explosive 
train  will  reliably  fire-through  when  the  rotor  is  in  a  po- 
;  3ition  25  degrees  from  the  fully  armed  position.  (This  is 
j  determined  by  explosive  train  reliability  testa  in  the  labora¬ 
tory.)  Therefore,  if  a  rotor  were  not  restricted  in  its 
t  rotational  movement  and  there  were  no  unbalance  tending  to 

orient  the  rotor  in  any  particular  attitude  under  normal 

'(  vibration  or  jolting,  a  random  distribution  of  angular  dis - 

\  placement  might  be  assumed.  Under  these  conditions  it  could  be 

l  said  that  the  rotor  would  be  in  a  fire-through  position  23/90 

i  of  the  time.  However,  since  the  rotor  is  unbalanced  and  has  a 

L  tendency  to  remain  in  the  unarmed  position  during  vibration  or 

L  jolting  when  the  fuze  is  in  the  vertical,  booster-down  post¬ 

er,  tion,  we  will  sav  that  the  reter  would  be  in  a  fire-through 
jr  position  1/2  x  2o/90  of  the  time.  Thus,  the  probability  that 

k  a  missing  shear  wire  will  result  in  an  armed  fuze  is 

IU  1/2  x  28/90  1/4  x  10“  3  or  (3*89)  10“^.*  Putting  this  into  the 

t-  decadal  system,  as  explained  in  the  following  note,  we  get 
I  1  x  10”4  which  will  be  used  as  the  value  for  in  all  situ¬ 
ations. 


*  The  rule  used  for  "rounding-off*  in  the  decadal  system 
when  an  actual  estimate  of  a  probability  is  given  is  determined 
by  at  least  squares  criteria  in  the  logarithm  of  the  proba¬ 
bility.  It  Is  as  follows:  The  given  estimate  is  written  in  tho 
form  K  x  10  ,  where  x  is  a  positive  integer  and  1<K<10, 

Then,  if  K  is  less  than  3.162,  the  estimate  used  in  the  analysis 
is  given  as  10“x.  If  K  is  greater  than  3.162,  the  estimate  used 
in  the  analysis  is  given  as  lO***”.  As  an  example.  If  an 
estimate  were  given  as  .000273  which  equals  2.73  x  10-4,  tho 
value  to  be  used  in  the  analysis  is  10”4,  If  the  estimate  were 
given  as  .000367,  the  value  to  be  used  would  be  10”^  since 

3.6 7  3-16.  In  an  analysis  of  this  type  where  products  of  the. 

individual  terms  arc  the  end  result,  this  form  of  rounding  off 
will  result  in  the  least  dispersion  of  the  result  from  the  term 
vu lue . 
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5.11  r'cr  other  situations  and  for  other  croups  of  o.  -nts, 
the  values  are  assigned  In  the  sar.e  earner.  In  this  analysis, 
a  value  of  ?  was  the  largest  assigned.  1*  c.n  to  seen  in 
Chapter  6  that  a  higher  value  of  the  v-x-rnent  would  r.ave  very 
little,  1?  e:iy,  significance  after  the  suit Ipllcaticn  of  the 
series  probabilities  in  a  path,  rurther-.-.r-. ,  it  is  felt  that 
predicting  a  probability  of  occurrence  cf  one  In  ter.  cillicn 
for  a  single  event  is  certainly  er.cugn  cf  a  strain  on  the 
interpretation  cf  data,  and  that,  although  probabilities  cf  this 
magnitude  and  sraller  say  actually  exist,  it  1s  unroascnacie  to 
believe  that  norcally  these  will  be  good  enough  bases  for 
predicting  thee. 

Beason  for  Pessimistic  Assignnents 

5.12  There  is  one  other  basic  rule  which  should  be  followed. 

In  the  case  of  those  urobabllit les  whose  ass i gnsent  is  based  on 
little  experience  and  data,  the  value  use3~r.i  this  first 

approximation  should  be  the  highest  cotsicerca ' lihely  or 

possible^  Ihat  is,  if  there  is  no  basis  for  saying  that  an 
event  probability  is  any  greater  than  1  x  10"~nor,  on  the  other 
hand,  that  it  is  any  less  than  10“ the  lO"*  value  should  be 
used.  If  It  turns  out  that  the  overall  hazard  terns  in  which 
this  probability  plays  a  part  are  avail,  nothing  has  been  lost. 
If  It  is  significant,  a  better  value  can  be  obtained  by  greater 
effort  In  a  second-ap, roxisaticn  analysis.  On  the  other  hand, 
if  a  low  prcbablllty  (high  exponent)  had  been  selected  and  the 
event  should  later  turn  cut  to  be  core  frequent,  its  signifi¬ 
cance  to  the  analysis  result  would  have  been  sissed. 

5.13  Other  exacples  of  the  reasoning  behind  the  choice  of 
probability  values  in  another  analysis  are  given  in  Apjcndix  b. 
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TABLE  5.1 

EXAMPLE  PE0BAB1LITX  VALuES 


Talma  of  X  for  Probability  Valua  =  1  x  10~x 
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CHAPTER  6 


SITUATION  OF  PATH  PROBABILITIES 

6*1  Table  5,1  lists  the  . r* cbr-billty.  associate  *H” 

the  "0"  events  (see  4.11)  occurring  in  all  situations  of  -he 
RAP  Analysis  of  the  Bomb  Fuze  EX-200.  In  a  complete  RAP 
analysis  similar  tables  would  be  prepared  for  all  events.  As 
explained  in  Chapter  5  these  are  exponents  for  the  base  lo 
and  are  listed  in  this  manner  to  tako  advantage  of  the  easi-r 
computations  of  the  decadal  system.  These  values  are  plugged 
into  a  situation  diagram  to  obtain  the  probability  factor. 

To  illustrate  this,  the  probability  factor  for  situation  i  , 
which  appears  in' Fig.  4-3,  will  be  computed.  . 

Preparing  the  Work  Sheet 

6.2  The  top  path  in  Fig.  4-3  is  QiTgOi.  This  is  a  series 
path,  and  its  probability  is  the  product  of  the  probabilities 
q.,  t8  and  01.  From  tables  like  Table  5.1,  we  would  find  that 

q,  carries  the  exponent  2,  t?;  the  exponent  1.  ana  that  o, 
carries  the  exponent  4.  This  means  that  Ql  has  been  assigned  the 
ttOuelC;  18 the  value  liT^and  0!  has  the  value  10  .  The  path 

probability  in  accordance  with  the  simple  rule  tor  series 
events  given  in  4.2,  is  the  product  of  those  individual  proba¬ 
bilities  %ncl  has  the  valve  10**'.  This  was  obtained  by  s-mp-jr 
adding  the  exponents.’  This  illustrates  one  advantage  of  the 

decadal  system. 

6.3  The  second  path  in  Fig.  4-3  is  QjTqO^;  the  third  path  is 

SiTq^;  the  tenth  path  is  QiP^^*  Table  6.1  lists  the  J„: 

paths  taken  from  the  normal  drop  situation,  (Fig.  4-3)*  I*  is 
a  work  sheet  used  in  the  determination  of  the  probability 
firtor  The  symbol  for  the  probability  of  *ccurrence  of  eech 
event  is  listed  separately  in  each  path  in  which  it  appears, 
and  under  each  is  placed the  value  of  the  exponent  obtained  from 
Table  5.1  and  similar  tables  for  other  events.  The  path  prob 
D^lity  exponents  appearing  in  the  right  hand  c^l^p  z  2 

sums  of  the  exponents  appearing  in  the  rows,  obtained  as  ,n  6.2. 

yhe  First  Approximation  . 

A  4  All  the  paths  or  rows  are  in  paralle1 .  Tb«  combination  of 

these^o  «u£»  «. 


of  the  equations  fcr  the  probubllxtie. 
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(Appendix  A).  The  equation  fcr  the  combining  of  the  porta¬ 
bilities  of  two  •<  arallel  independent  invents  is  giver  in  in^n- 
feraph  4.2  and  is  p»  p,  4*  P2  ”  Pil'2*  When  two  events  are 

exclusive  the  equation  is  P=  pJL+  p2.  Although  those  c,,uut ! 


OM 


aue»  o:.f.picr-c-..un  -pulhs  tne> 
illustrate  that  the  first  order  terms  are  simply  added.  Tht: 
is  the  first  step  in  the  summation  of  path  probabilities;  i .* 
P  »  4-  P2  is  taken  as  a  first  approximation  of 


p  ~  Pj +  p2  ~  PpP2  w^en  it  applies,  and  as  illustrated  in 
paragraph  4,8,  this  is  often  a  satisfactory  approximation. 


6.5  bumming  the  path  probabilities  tn  obtain  a  first  approxi¬ 
mation  of  the  probability  factor  for  the  situation  is  quite 
simple  as  long  as  the  gecadal  system  is  employed.  For  example, 

10“6  -  C.COOOOOOlj  10”°  4-  10"8-  0.0000C002;  and  10“64-  10”8  + 

+  10“  —  C.00C00102.  It  will  be  noted  that  the  appearance  of 
the  exponent  -8  placed  a  unit  in  the  eighth  place* to  the  right 
of  the  decimal;  the  addition  of  two  path  probabilities  of 

value  10”  placed  two  units  in  the  eighth  place;  and  the 

addition  to  this  of  the  value  10”8  placed  a  unit  in  the  sixth 
place.  If  a  table  is  set  up  with  exponent  column  headings,  the 
probability  factor  for  a  situation  will  be  obtained  as  a 
decimal  fraction  simply  by  placing  the  number  of  path  proba¬ 
bility  exponents  under  the  appropriate  columns  remembering,  of 
course,  that  each  time  1C  or  a  multiple  of  ten  is  reached,  the 
column  to  the  left  is  Increased.  A  table  of  the  data  obtained 
from  Table  6.1  Is  given  below. 


c  i 
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This  table  shows  that  under  the  path  probability  column  of 
able  6.1  there  was  1  -  three,  1  -  four,  1  -  five,  1  -  six, 

-  sevens,  9  -  eights,  etc.  Of  course,  this  sam®  .-^'iult  could 
have  been  obtained  if  the^e  had  been  no  -  sixes  ..4  -  sevens. 
Al]  exponents  are  negative. 
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6.6  The  first  app.roxJ.irat ion  of  the  probability  factor  can  be 
carried  as  it  appears  in  the  t'-ble  or  can  be  shifted  to  other 
decimal  units.  Since  an  accident  rate  of  o..«  In  one  million 


is  a  goal 
answer  in 
factor  in 
Talio  6.2 


in  fuze  design,  it  seems  advisable  to  carry  the 
millionths.  The  approximation  of  the  probability 
vei.  1111.49  x  10“°. 

1' y  raWW^^-roxlmation  work  sheet 
for  all  -'ituatiens  involving  the  LX-200  bomb  fuze.  The 
figures  rore  obtained  by  the  processes  described  in  the  above 
paragraphs. 


the  examoleMi 

lil  *£  \ 


6.7  in  Table  6.2  the  probability  factors  are  carried  out  to 
the  exponent  16  (i.e.  tc.  1C"*®).  It  is  apparent  that  many  of 
the  places  carried  are  not  significant  and  that  the  sub¬ 
traction  or  addition  of  the  larger  cross  product  terms  would 
change  figures  far  to  the  left  of  the  16th  place.  However, 
there  is  one  advantage  in  carrying  a  lot  of  apparently  mean¬ 
ingless  places  in  the  work  sheet.  If  some  change  Is  made  in 
the  device,  the  direction  of  the  effect  can  be  observed  by 
simple  addition  or  subtraction  no  matter  how  small  it  may  be. 
But  it  must  be  remembered  that  it  is  not  correct  to  state  that 
the  probability  of  accident  in  situation  "a"  is  3*3224473  x 
10"®,  for  such  a  statement  implies  an  accuracy  which  is  known 
not  to  exist  in  the  first  approximation. 

Magnitudes  of  Errors 

6.8  At  this  stage  in  the  analysis  arriving  at  a  numerical 
value  which  is  sufficiently  accurate  to  be  quoted  as  the  pro¬ 
bability  factor  for  the  particular  situation  requires  three 
basic  steps.  These  arei  (a)  a  critical  review  and  re-evalua- 
tion  of  the  path  or  paths  which  contribute  the  greatest  amounts 
to  the  numerical  values  of  the  first  approximation,  (b)  a 
review  of  the  effects  in  these  paths  of  rounding-off  values  as 
part  of  the  decadal  system,  and  (c)  &i.  assessment  of  the 
corrective  effects  of  cross  products.  Step  (a)  Is  necessary 
since,  as  pointed  out  in  Chapter  5,  many  cf  the  probability 
values  are  assigned  on  the  basis  of  personax  opinion  or 
Judgment.  Assuming  there  has  been  reasonable  consistency  in 
the  personal  trait  of  optimism  or  pessimism  which  influenced 
the -judgment  in  assigning  these  values,  the  paths  which  con¬ 
tribute  the  most  tc,  cr  actually  control  the  magnitude  r-*  the 
probability  factor  are  the  more  likely  causes  of  accidents  ana 
therofore  should  be  the  focal  points  cf  study  cr  testing.  Inis, 
step  is  therefore  a  "second  look"  to  see  if  there  is  sub¬ 
stantial  background  for  these  influential  choices,  iter,  (b)  is 
to  determine  If  the  system  of  round :ng-of;  r;  .^-mended  with  the 
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decadal  system  has  biased  the  results  to  the  excent  that  the 
P»'ith  appearing  to  bo  the  r.ost  liioly  •.  ause  of  accident  actually 
is  not.  For  example  a  value  of  i/jCC  based  on  test  or  actual 
experience  would  be  rounued-off  tc  1/ICO.  If  this  were  to 
happen  several  times  in  a  path,  the  path  answer  could  be 
affected  by  a  factor  of  10.  Step  (cj  is  a  more  mechanical 
step.  Its  primary  purpose  is  to  obtain  an  idea  of  the  mag¬ 
nitude  of  the  error  in  the  answer  which  is  attributable  to  lack 
of  rigorous  mathematical  treatment.  In  this  step  the  larger 
cross  product  terns  may  be  applied  to  the  answer  cr  may  be 
ignored  after  it  has  been  established  to  what  extent  they 
influence  the  an-v.ur.  The  step  also  includes  decisions  re¬ 
garding  the  existence  or  non-existence  of  cross  products,  and 
therefore  requlro.;  that  the  relationships  of  the  events  bo 
classified  as  either  independent  or  exclusive  (•1.29  and 
Appendix  A) . 


6.9  Situation  "i"  will  again  be  used  as  the  example  illus¬ 
trating  steps  of  the  analysis.  In  Table  6.1  it  is  noted  that 
the  path  has  a  probability  greater  than  any  other  path. 

Sills  defined  as  the  event  that  the  4-1/P:  second  actuator  burns 
very  fast  or  gives  no  delay.  (*4  is  defined  as  the  event  that 

the  reed  sv^itch  in  the  instantaneous  primer-  and  %  millisecond 
primer  circuit  is  closed  or  closes.  T9  modifies  the  proba¬ 
bilities  based  on  6-1/2  seconds  since  the  accident  can  only 
occur  in  4-1/2  seconds.  Since  it  is  rounded  off  to  1  it  does 
net  contribute  to  the  path  velu®.  The  combination  of  these 
events  would  cause  tomb  explosion  before  safe  separation  had 
teen  attained.  This  is  clarified  by  reference  tc  Fig.  3-1. 

The  delay  provided  by  the  2  second  actuator  will  allow  the 
bomb  to  fall  some  distance  from  the  plane  but  since  the 
designed  safe  separation  time  is  6-1/2  seconds  tnls  js 
obviously  not  yet  a  safe  distance.  If  then  the  4-1/2  second 
actuator  gives  no  delay  and  closes  the  primer  circuit  in  which 
the-  reed  switch  is  already  closed  the  bomb  will  explode  two 
seconds  after  release,  iihort  turning  of  the  4-1/2  second 
actuator  is  a  variation  which  would  permit  more,  but  presumably 
not  enough,  separation  of  bomb  and  airplane  af  the  tine  of 
dot.  oration* 


6.10  The  probability  wus  assigned  Lhu  value  1C  .  Tilts 

means  that  on  the  average  it  was  felt  that  one  In  a  hundred  of 
the  4-I/2  second  delay  actuators  would  burn  through  very 
rapidly  or  give  no  delay.  This  rather  pessimistic  estimate- 
may  be  based  cr.  a  distrust  cf  pyrotechnic  delays  --  bad 
experience  with  some  such  delays  or  a  combination  <  .  ..oth. 
Experience  with  pyvotcchnic  delay  columns  has  indie.- ted  the* 
cc Icy c  2..  .y 


Best  Av 


o  s  1  r, 

ciU  a 


his  Copy 


60 

CONFIDENT JAL 


COrtf  xuiiii  1AL 
NAVOzll)  REPORT  41  35 


else  "fire  through"  without  delay.  This  tendency  to  "Tire 
through"  appears  to  relate  to  such  factors  as  vigor  of  initia¬ 
tion.  nature  ni‘  confining  '.■/ails,  and  delay  column  length,  lima 
great  variations  in  this  regard  can  be  exrected  from  different 
physical  arrangements ,  and  the  tendency  for  any  particular 
delay  element  to  "fire  thj. •.^ug^,',l  must  ultimately  be  Judged  on 
the  basis  of  its  performance.  Lacking  such  information 
figure  of  10“  was  selected  on  the  basis  of  test  work  performed 
on  two  delay  cartridges,  one  having  a  nominal  delay  of " two 
seconds  and  the  other  a  delay  of  five  seconds.  Although  these 
delay  cartridges  are  initiated  by  a  percussion  primer  and  also 
differ  in  other  physical  aspects,  there  seemed  to  be  too  little 
evidence  to  assume,  at  this  time,  that  the  delay  actuators  of 
the  bomb  fuze  would  be  less  likely  to  "fire  through".  In  1049 
tests  of  the  two  second  delay  cartridge  saven  "fired  through" 
thus  giving  a  best  estimate  of  1/150- on  the  average.  In  283 
tests  of  the  five  second  delay  cartridge  two  fired  through 
thus  giving  a  best  estimate  of  1/141.  The  value  of  one  in  one 
hundred  was  therefore  assigned  to  adhere  to  the  decadal  system. 
Someone  having  more  confidence  in  this  particular  design  might 
have  chosen  a  figure  like  10“4  or  1CT'  and  in  either  event  this 
would  have  a  marked  effect  on  the  value  of  the  probability 
factor.  11*  these  two  people  were  to  get  together,  they  might 
settle  on  an  Intermediate  value,  but  the  point  that  Is  brought 
out  is  that  this  is  an  area  in  which  testing  is  important. 
Unless  the  estimates  are  actually  ludicrous  the  RAP  Analysis 
will  point  to  the  areas  of  danger  which  require  attention 
through  remedial  measures  or  proof  that  the  opinions  involved 
were  far  too  pessimistic.  Because  of  the  curtailment  of  this 
fuze  development  the  burning  times  of  these  specific  actuators 
were  not  adequately  checked  and  the  estimated  value  of 

remains  doubtful. 

6.11  The  other  event  of  Interest  Ir.  this  path  is  Q4.  The 
value  of  1C”1  assigned  to  was  based  on  some  knowledge  of  the 

sensitivity  of  the  switch.  Tests  demonstrated  that  these 
switches  could  be  functioned  by  drops  of  a  fraction  cf  an  inch. 
Lacking,  however,  is  sufficient  information  on  the  types  of 
shocks  or  internal  vibrations  which  the  bomb  might  encounter 
in  flight,  the  frequency  with  which  bombs  may  be  expected  to 
bump  other  bombs,  and  th®  probability  that  switches  wlP  be 
defective  through  premature  closure.  Thus  q4  may  also  be  a 

pessimistic  estimate  which  would  be  improved  if  ail  the  facts 
were  known.  The  value  of  re-examination  of  the  path  is  to  (a) 
confirm  that  the  path  is  a  valid  accident  path,  (L)  show  where 
more  effort  should  be  placed  In  the  gather!  .g  ind  analysis  of 
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available  information  or  in  testing  a -a,  (c)  note  how  changes 
can  improve  t.ho  •'•ttuetion.  In  the  example  given,  there  is 
considerable  doubt  that  the  path  Is  as  dangerous  as  these 
figures  Indicate.  Fat  if  we  assume  that  these  figures  are 
substantially  correct,  the  analyses  shows  that  oeh  improvement’ 
in  this  individual  situation  can  be  obtained  by  (1)  use  of  a 
less  sensitive  switch,  and/or  design  of  switch  to  reduce  the 
possibility  of  closure  as  a  defect,  and  (2)  increasing  the 
reliability  of  the  delay  tine. 

6.12  The  inspection  of  paths  for  the  effects  cf  rounding-off 
is  most  useful  when  two  paths  have  the  same  value,  for  by  this 
process  it  may  be  possible  to  determine  which  of  the  two  paths 
is  the  slightly  more  probable  cause  of  accident.  For  paths  of 
nearly  equal  value  to  differ  by  a  factor  cl'  1C  in  the  decadal 
system  requires  an  unfortunate  combination  of  rounded-off 
values  in  one  or  both  of  the  paths.  'Ihe  examination  cf  all 
events  relative  to  each  other,  for  the  effects  of  cross  products 
is  a  tedious  process  which  usually  yields  loo  little  to  justify 
the  work  involved.  The  probability  factor  for  situation  "1" 
determined  with  the  consideration  cf  all  cross  products 
(Appendix  A)  differs  only  slightly  from  the  first  approximation. 
In  general  the  consideration  of  the  effects  of  rounding-off  and 
of  the  Exposure  and  Severity  Factors  should  be  undertaken  before 
any  cross-product  study  is  made  since  these  effects  will  usually 
overshadow  any  cross-product  terms. 

0.13  The  process  of  checking  th.*  effects  of  cross-products  can 
be  greatly  simplified  when  only  the  largest  paths  are  considered 
The  significant  products  will  usually  come  only  from  the  high 
probability  paths.  The  largest  contributions  to  the  proba¬ 
bility  factor  approximation  of  situation  "i"  come  from  the  paths 
containing  the  events  C'n  and  Q4  (Table  6.1)  •  The  chances 

are  very  good  that  the  largest  cross  products  will  come  from 
combinations  containing  q-p  q^  and/or  q4. 

6.14  The  first  step  is  to  assume  that  the  events  appearing  in 
naths  rarallel  to  the  path  of  highest  accident  probability  are 
independent  of  the  evants  in  the  path  of  highest  probability 
anu  therefore  have  cross  products.  From  Table  6.1,  we^find  that 
the  two  most,  important  paths  are  CIO”-*)  and  Oily^  (1C*  .. 

Referring  to  Fig.  4-3,  we  see  that  these  paths,  if  independent, 
would  combine  to  give  a  cross  product  qitsqijt^  with  a  value 
cf  1Q~  .  If  the  assumption  of  independence  is  correct,  the 
first  approximation  probability  factor  for  situa'-Jw;'  M" 

(Table  6.2)  would,  ny  this  one  cross  product,  be  corrected  to 
1110  x  1C-5.  However,  to  check  the  assumption  of  Independence , 
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It  Is  necessary  to  examine  the  definitions  of  events.  Ihese 
are  given  in  Table  4.1. 

6.15  For  all  practical  purposes ,  it  seems  reasonable  to  con¬ 
sider  yj  (short  or  no  delay  of  2  sec.  actuator),  C^l  (short  or 

no  delay  of  4—1/2  sec.  actuator),  and  treed  switch  is  closed 

or  closes)  as  independent.  But  on  examining  the  definitions  of 
Tg  and  T^,  we  find  that  by  definition  Tg  requires  that  event 

Qji  and  not  occurs  and  that  requires  that  event  and 
not  Ci  occurs.  These  X's  establish  the  mutual  exclusiveness  of 
the  paths  considered  and  the  cross  product  considered  in  the 
above  paragraph  does  not  exist.  In  retrospect  this  is  quite 
apparent.  In  the  diagram  (Fig.  4-3),  we  note  that  in  addition 
to  the  paths  we  chose  for  first  consideration,  there  are  three 
paths  containing  CiQn»  viz.  CidiOi,  Q1Q11O5,  and  Q1Q11Q4. 

The  fact  that  a ’special  path  was  put  into  the  diagram  to  give 
the  C1C11  combination  was  in  itself  a  "red  flag",  for  the  co- 
exiStar.ee  of  Cj  and  Cn  would  be  automatic  if  the  two  paths 
containing  Qi  and  singir  had  been  independent .  *,;e  note 

that  further  down  in  the  diagram  this  independence  is  recognized. 
For  example,  the  cross  product  qiqnpi2  exists. 


6.16  Continuing  with  the  investigation  of  the  highest  proba¬ 
bility  paths,  it  is  necessary  to  examine  the  cross  products 
resulting  from  the  combining  of  O3O5,  O1Q4,  and  O5Q4.  The 

largest  cross  product  coming  from  these  is  qiit9°iq4  with  a 
value  of  10-7,  ^he  next  iargest  js  qjtgo^q^.  with  a  value 
of  10“  .  The  product  has  a  value  of  10“ ;.  Consider¬ 

ation  of  the  definitions  of  Oi»  0^,  and  O4  leads  to  the 

conclusion  that  there  is  no  reason  not  to  consider  them  as 
independent.  A  continuation  of  this  process  will  show  that 
there  are  no  other  cross  products  which  contribute  as  much  as 
10“9  to  the  probability  factor.  The  cross  products  considered 
will  change  the  probability  factor  of^situation  "i"  from^a 
first  approximation  of  1111.496  x  10-'-'  to  1111. 385  x  10“°, 


6.17  As  mentioned  in  paragraph  6.12,  the  effects  of  rounding- 
off  values  to  remain  in  the  decadal  system  may  have  far  more 
effect  on  the  value  of  the  probability  factor  than  the  cross 
products.  A  good  exsmple  of  thi3  is  found  in  the  ?n  and  T^ 

events  appearing  in  situation  "1".  These  ev  j  were  defined  as 
transforms  with  the  exact  values  of  2/6- 1/2  i.*ui  4-1/?/ 6-]/ 
which  were  minded-off  tn  0,1  and  1,0  respectively.  Neglecting 
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cross  products  entirely  we  will  examine  the  effect  cf  rounding- 
off  these  values.  Tg  appears  in  three  paths;  viz,  (^-^TgO^, 

^1^8*5*  and  .  Tq  also  appears  in  tiii’ee  paths j  viz. 

^ll1  V°'lT*'^flPPf!^‘ 6  contributed 

the  value  O.OOllOllOl  to  the  first  approximation  probability 
factor,  by  using  the  exact  values  of  Tg  and  and  leaving  all 

other  values  unchanged,  we  find  that  these  six  paths  should  have 
contributed  0.001001001  to  the  probability  factor.  *  Thus  the 
use  of  the  decadal  system  on  Tg  and  T^,  which  had  established 

intermediate  values,  gave  us  a  first  approximation  which  was  coo 
large  by  the  amount  0.C00100100,  and  a  better  second  approxi¬ 
mation  is  1011.3965  x  10“b.  The  consideration  oi  cross 
products  v/ould  further  reduce  this  value  but  to  a  much  less 
extent  than  the  rounding -off. 


*  This  step  involves  departure  from  the  decadal  system 
in  determining  the  path  values.  In  this  case  It  was  sJmolifi  d 
by  the  fact  that  tg  +  in  **  1  and  ct^  =  q2  =  10"  ,  The  six  paths 

are  given  by  the  expansion  of 

=*  10"2(tg-t'  t9)(10“4+10”7-f  io*  l) 

*  10"6H*10"9-t-lC"3  =  0.001001001 
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CHAPTER  ? 


EXFCSURB  FACTOR 

7.2  The  need  and  sic.iiricaiic._qf,  .-.uosure  factor  In  the 
ttxf  Analysis  is'crieily  Ecnticncif  in  unaoter  a.  Seen  a  factor 
is  necessary  so  that  ad'ustxcnts  can  be  cade  for  the  relative 
frequencies  sith  thick  the  ordnance  is  exposed  to  the  -arlcus 
situations.  Fee  exarpJe,  all  fates  manufactured  *123  not  be 
Involved  in  all  situations  in  thick  the  fuze  till  be  the  source 
of  accidents.  It  could  he  foolhardy  to  rut  as  cuch  effort  into 
designing  fee  safety  in  er ashes  as  in  norma!  handling  unless 
crasl.es  become  tore  corr or:.  In  order  to  ret  a  tore  realistic 
figure  xhich  characterizes  the  safety  of  •.•  piece  of  ordnance 
in  a  particular  situation,  it  Is  necessary  to  define  an  expos¬ 
ure  factor.  The  exposure  factor  (h)  is  the  mutter  of  tines  to 
rhich  the  overage  piece  cf  erdnanee  is  exposed  to  the  partic¬ 
ular  situation.  It  then  teeooes  one  tern  in  the  product  FLd 
(discussed  in  Chapter  2)  which  rates  the  overall  hazard  cf  the 
device  in  a  siturtion. 


7.2  A  cnooledge  of  the  probability  cf  an  accident  In  a 
situation  or  the  damage  which  it  zould  ceuse  cannot  give  an 
overall  picture  of  the  hazards  cf  a  situation.  Even  thourh  lie 
accident  probability  and/or  severity  of  such  an  accident  cay 
be  high  in  a  particular  situation,  if  the  expectation  of 
exposure  to  the  situation  is  negligible,  the  overall  hazard 
free  the  ordnance  is  not  necessarily  great.  It  seers  that 
little  cculd  be  gained  and  cuch  cay  be  lest  by  expensive  effort 
to  recuco  the  nrccahllity  of  an  accident  in  the  situation,  if 
the  safety  irdex  is  already  loa  because  cf  the  weighting 
influence  of  the  exposure  factor.  For  exacple  sor.e  point 
uetoiwting  rcclet  fuzes  are  ceslg.ied  to  be  very  sensitive  so 
as  to  be  effective  against  c-dorn  alisraft.  There  is  consid¬ 
erable  concern  over  the  fact  that  they  can  be  Initiated  by 
rain.  Thus  the  probability  cf  an  uceicenr  in  an  air-to-air 
cento!  situation  there  the  rcc, ots  are  fir-d  in  a  rail,  store 
aculd  be  very  high,  fn  first  thought  -no"  eight  decide  that  it 
Is  necessary  tc  re-soslrn  the  fuze  tc-  prevent  an  accident  tc 
the  launching  iSroraft.  He  rover,  t.-.:s  Is  found  to  be  unneces¬ 
sary  upon  examination  of  the  exposure  factor  zr.ich  !ndv  tvs 
that  the  need  for  gooa  visibility  in  air-to-air  ccnhat  c  >'J"cs 
cost  of  *hc  IT! ire  to  occur  above  the  clouds. 
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it  can  t&.te.  ihc  exposure  faster  is  .  dimensionless  nuster. 
since  nest  situations  arc  part  of  the  normal  lire  fclsicry  of 
the  fuze,  the  average  fuze  will  be  exrcsed  tc  *.!  em  once  and 
only  once.  The  nest  cersmen  value  cf  the  exposure  factor  sill 
therefore  he  unity.  Ir.  other  situations  which  -re  described  - 
as  unintended  or  abnormal,  the  average  fuze  is  not  exposed 
ever,  cnee  and  the  factor  cay  be  cons Ider-bly  less  than  unity. 

The  exposure  factor  cay  also  have  a  value  greater  than  unity 
due  to  the  fast  that  or.  ordnance  Iter  can  under  certain 
circumstances  (to  be  discussed  later)  be  exjoseO  tc  a  situation 
core  rices  than  one. 

Attenuating  Effects 

7.4  Ifce  significance  of  the  exposure  factor  c--.  sc  illustrated 
by  comnaring  its  effect  in  two  different  situations.  For 
Instance,  in  situation  "h.“  (return  and  landing  -with  hung 
ordnance),  the  plane  is  returning  after  nap in;  an  attcapled 
drop.  Prior  tc  the  return,  everything  appeared  tc  te  normal 
until  it  uas  found  that  the  bcr.b  failed  tc  drop,  necessitating 
that  the  clone  return  vtth  the  ordnance.  The  frequency  of  this 
occurrence  is  not  toe  difficult  tc  ascertain  and  a  feeling  for 
this  value  can  be  found  by  a  study  of  available  operation 
statistics.  Since  It  appears  that  this  situation  is  not  too 
infrequent,  an  exccsure  factor  of  0.1  was  -hosen  as  being  a 
fairly  realistic  value.  For  comparison,  sltuaticn  “1“  (crash 
landing  with  hung  ordnance)  is  considered.  Ti  ls  sltuaticn 
Is  sicllar  to  "k“  oxcept  that  there  the  plane  crashes  during 
the  landing.  Since  e  crash  cn  ian-lng  slth  hung  ordnance  is  a 
much  less  frequent  occurrence,  an  exposure  value  cf  C.CCCC5 
was  selected,  which  means  that  cn  the  average  1  in  2C,GC0 
bent  fuzes  will  be  exposed  to  crash  lancing  -ith  hung  ordnance, 
cr  co  could  say  that  the  expectation  cf  the  average  fuze 
exreriencing  this  situation  Is  1  In  2C,CCC.«  As  discussed 
earlier  in  the  report,  the  KAr  index  for  a  situation  is  the 
product  Pia  (F*»  Probability  factor,  £  *  exposure  factor,  and 
a—  severity  factor).  By  examining  the  values  in  -r»  prccuct 
Pid  for  these  two  situations,  It  Is  seer,  that  *he  severity 
factor  for  situation-  "k”  and  "1“  are  the  rare  (3  x  1C'  rrep 
Table  i.l)  The  best  estli»at«s  cf  the  probability  cf  an  accident 
in  these  tec  situation:,  ac  determined  by  the  situation 


•  CSC  Ccnf  itr  tc  I'CL  Cp-53-' •' see  --r.  C153-J3  --  '  lop 
1953  gives  statistics  cr.  the  frequency  of  c»rri-:r  rases  a:-- 
craft  accidep.it.  Although  the  expos'- re  faster  .'t’mticn 
"lr  .as  a. I  iira-lly  derivable  from  V-ese  statir'Ic-  they  dc 
indicate  that  th’  ::.-tcr  is  t..e  right  order  *f  ragr.  '-ce. 
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analyses,  ir#>  approximately  355  *  10“^  fvr  aaluuwicr  rl 

and  65'i  r  lx~''  : cr  actual ic:s  Iris  l.tcicatts  that  the 

probability  cf  cn  accident  in  situation  "l"  is  almost  twice 
that  Jn  situs tion  HkH.  however.  *».»-*  is^  respective  PLS 
values  Tor  l;:«  two  situations  •ire  coup::*.’.,  it  is  fou.d  that 
the  ex reeled  accident  erst  frerr.  crash  landings  with  hunc 
oranance  is  about  one  thousandth  of  that  free  normal  landings  *t*h 
hung  ordnance.  Thus  it  is  seen  that  although  the  probability 
of  an  accident  in  situation  M1M  is  twice  as  great  as  In  *'r", 
the  potential  hazard  presented  by  situation  "1"  *.j  less 
because  of  the  very  lew  exposure  factor* 

hxanpie  Analysis  Values 

7*5  As  discussed  earlier,  nc*»t  of  the  nerval  situations  that 
ari^c  In  the  life  history  of  a  fuze  will  have  an  exposure 
factor  of  1.  Actually  about  half  the  situations  named  In  this 
analysts  pertain  to  getting  the  fuze  fre-r.  the  Manufacturer  tc 
the  situation  where  it  is  dropped.  In  order  fer  a  fuze  to  live 
a  nornal  life,  it  Must  be  exposed  to  these  conventional 
situations  at  least  once.  The  situations  which  fall  into  this 
category  are*  storage,  handling,  etc.;  fuzing;  connecting 
fuzed  boat  to  airplane;  on  deck  before  take  off;  take  off;  and 
flight.  The  situation  of  .r.oraal  drop  is  an  Intended  part  cf  tie 
life  history  of  all  fuzes.  However,  It  will  not  have  an 
exposure  of  uaity  since  a  fair  percentage  of  fuzes  for  various 
rtusons  are  returned  tc  base.  Consequently,  fres  study  of 
operational  repoits,  and  discussions  with  cognizant  personnel, 
It  seems  that  a  reasonable  figure  for  ♦he  exposure  factor  for 
nornal  drop  is  C.7*. 

7*6  Since  the  conventional  situations  concern  the  prepare* ion 
of  the  fuze  for  its  intended  use,  the  remaining  situations, 
which  we  think  cf  o s  unintended  cr  abnormal,  concern  that 
portion  of  the  life  history  resulting  from  fallu-e  cf  a  fuze  to 
be  nornal! y  dropped.  Not  all  fuzes  which  experience  the 
situation  of  fUg**  will  be  normally  _ropp  1.  Thvae  f-ues  -l'il 
be  returned  tc  the  carrier  or  jettisoned.  Jettisoning  is 
considered  as  a  specie  1  forn  cf  nornal  drop  anc  is  net  con¬ 
sidered  this  analysis  (see  paragraph  The  diugror. 

ci  Fig-  7-1  shows  tK:  relationship  of  the  various  aituai’c.ns 
to  each  oti.-er  in  a  tins -wise  fashion  and  he**  *fc»  exposure 
factors  are  iivided  n*en«:  tuctions.  Si..ce  the  *•»<*-.«£»  fuze 
usually  is  subjected  to  the  normal  situations  from  at-  u 

handling  trough  flight  (see  Fig.  7-1),  the  exposure  factor  is 
1.0.  7t  is  true  that  a  snail  numcer  cf  t-c  r— ~vee  free 

storage  for  test  purposes,  but  this  is  -rc-'si  -red  to  have  • 
negligible  e'foct  on  inc  exposure  factor-.  Figure  7-1 
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Into  other  situations  as  shown  in  che  diagram.  A  value  of 
0.15  has  been  assigned  to  situation  "3"  (return  and  normal 
landing),  statistics  indicate  that  there  is  a  fairly  high 
incidence  of  planes  returning  with  hung  ordnance  in  which  the 
ordnance  pulls  free  of  the  plane  and  is  subjected  to  deck 
impacts;  for  this  reason  it  has  been  given  an  exposure  factor 
cf  0.1.  Crash  cn  landings  with  hung  or  normal  ordnance  are 
not  excessively  common  so  this  type  of  situation  has  been 
assigned  a  relatively  low  exposure  factor.  Thus  it  is  scan 
that  the  fuzes  which  are  exposed  to  the  situation  of  flight 
and  are  not  dropped  are,  in  most  cases,  exposed  to  the  two 
situations  discussed  above,  Some  fuzes  are  subjected  to  other 
situations  as  shown  In  Fig.  7-1*  but  their  exposure  factors 
are  very  small  and  thus  will  not  affect  significantly  the 
exposure  factors  assigned  situations"jH  and  "k". 


/./  me  situation  cf  uei'uz’ng  which  concerns  the  removal  of 
•:he  fuze  fc?  any  reason  at  all  may  be  classed  aa  an  unintended 
situation.  It  is  certainly  undesirable  to  have  to  defuze  a 
tomb;  however,  it  is  necessary  in  some  cases  even  though  the 
fuze  may  never  have  been  connected  to  the  plane.  Most  bombs 
that  are  returned  and  are  subjected  to  a  normal  landing  will 
be  defuzed.  In  some  instances  defuzing  will  takra  place  In 
these  situations  which  are  abnormal  such  as  return  and  landing 
with  hung  ordnance  or  crash  landings.  In  considering  all  the 
instances  in  which  defuzing  occurs,  both  in  returned  ordnance 
and  that  not  subjected  to  flight,  a  value  of  0.*5  was  selected 
as  an  exposure  factor.  The  exposure  factors  for  all  the 
situations  of  this  analysis  «re  listed  in  Table  7.1. 

Dependence  on  Tactical  Doctrines 

7.L  As  mentioned  above,  the  exposure  factor  can  ;  ssur.e  a 
value  greater  than  unity.  This  would  occur  in  cases  where  the 
ordnance  may  be  taken  out  on  a  flight  mission,  returned  and 
defuzed,  then  later  used  on  another  mission.  This  would 
usually  be  the  result  of  standard  usage  of  the  urdn&nce  item. 

An  example  of  this  would  be  an  aircraft  parachute  flare  which 
In  left  on  board  the  aircraft  until  it  is  fired.  Thus  it  would 
get  repeated  exposure  to  the  flight  situation, 

7,9  The  exposure  ractor  does  not  necessarily  r  a  fixed 

value,  uni.  as  expressed  in  Chapter  2,  its  variatio..  may  fre¬ 
quently  be  the  result  of  changes  in  tactical  doctrine  or  fie la 
h  muling  procedure  rcr  example,  instructions  mev  be  iesued 
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TABLE  ?.l 

=za;;ple  esposiss  factcbs 

Situation  Exposure  Factor 


a.  Storage,  Handling  and  Transportation 


Outside  Ordnance 

1.0 

b. 

Fusing 

l.C 

f 

c. 

Defusing 

0.25 

t 

d. 

Fused  Scab  Handling 

0.01 

i 

a. 

Connecting  Fused  Boeb  to  Airplane 

1.0 

r 

f. 

On  Deck  Before  Take  Off 

1.0 

£- 

Take  Off 

1.0 

- 

h. 

Flight 

1.0 

i- 

Korr-al  Drop 

0.75 

\ 

J. 

Heturn  and  Formal  landing 

0.15 

b 

k. 

Return  and  landing  with  Hung  Ordnance 

0.10 

i 

1. 

Crash  on  Landing  with  Bung  Ordnance 

o.oocow 

ir 

1 

B. 

Crash  cn  Lauding  with  Dorsal  Ordnance 

0.000075 

? 

f 

n. 

Rendering  Ordnance  Safe  cr  Disposal  of 
Ordnance  After  Crash  landing 

O.COC125 

» 

0. 

Honoring  Eceb 

0.01 

* 
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SEVERITY  FACTOR  ASSICSKEST 

8.1  The  severity  factor  (s)  represents  t..v.  average  "loss’1 
In  a  given  situation  for  a  particular  accident  and  as  used 
In  this  analysis,  Is  expressed  in  terns  cf  dollars.  As  dis¬ 
cussed  in  paragraph  2.6,  the  loss  as  a  result  of  an  accident 
or  “cost"  of  an  accident,  may  be  divided  Into  tiro  parts:  (11 
tangible  considerations  (S^l  atiich  would  be  the  cost  resulting 
froa  material  loss  or  damage;  and  (21  intangible  considera¬ 
tions  (S2)  which  would  be  the  cost  resulting  froa  seen  things 
as  tha  loss  cf  life  and  injury  ts  personnel,  etc. 

Tangible  Considerations 

8.2  Once  assumptions  as  to  type  of  pact-aging,  carrying  air¬ 
craft,  slxa  of  bomb,  etc.  to  be  considered  typical  of  the  use 
of  the  ordnance  Item  are  agreed  upen,  fairly  good  values  for 
the  tangible  enst  of  cn  accident  In  e  situation  can  often  be 
arrived  at  free  data  available  with  a  little  searching. 

However,  the  nost  Important  aspect  for  the  usefulness  of  the 
analysis  Is  the  relationship  between  the  values  for  the  dif¬ 
ferent  .situations,  and  these  ratios  should  be  checked  for 
reasonableness.  There  will  be  little  argument,  for  example , 
that  the  average  cost  of  »n  accident  occurring  on  a  flight 
deck  at  landing  and  Involving  the  explosion  of  a  1COO  lb. 
boob  Is  greater  then  that  of  tha  same  explosion  aboard  the 
aircraft  In  flight,  since  damage  to  the  aircraft  Is  the  seme 
In  either  case  end  that  to  tha  carrier  and  ether  planes  aboard 
must  be  additional.  The  greatest  difference  In  S-factor 
values  will  normally  occur,  cf  course,  tetween  those  situation* 
where  only  a  booster  explodes  and  thr._e  where  the  mein  charge 
Is  detonated.  The  choice  of  any  reasonable  ratio  for  these 
values  will  go  much  of  the  way  toward  properly  weighing  the 
relative  accident  consequence  between  sltua.ioas. 

j.3  Since  such  assunnti oas  as  whether  a  250  It.  or  2000  lb. 
bomb  Is  being  used  with  the  fugw,  whether  Its  norcal  use  Is  off 
carriers  or  air  fields,  etc.  will  wired  s-fectors  greslay, 
these  assumptions  must  be  stated  specifically.  The  degree  to 
which  Intangible  (S21  considerations  are  included  -mist  also  hr 
stated.  In  general.  It  may  be  best  to  emit  tnese  in  uahing  a 
first  analysts  and  to  Include  then  later  c.  v  if  tl.fi/  are  found 
to  be  essential  In  arriving  at  the  specific  -iz.'.nis*r** ivc 
decisions  ah.cb  ere  sought.  In  this  fi*:.«l-si-,  th.c  in* a.-.p  ' ie 
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losses  (S^)  were  r.ot  included  lii  the  severity  factor,  but  »**e 
discussed  In  paragraph  6.1*  rid  6.13* 

Value  Aaslgnraata 

8.4  For  this  particular  analysis,  sit  silon  "h3 ,  wr.lch  is  the 
plane  in  flight  with  fuzed  tests  ready  to  drop,  has  been 
selected  as  the  starting  point  for  severity  factor  assignment. 
This  situation  was  selected  as  the  first  for  consideration 
because  if  an  accident  occurs  during  flight,  only  the  plane 
would  he  involved  and  it  would  be  considered  a  total  loss. 

<«  will  say  that  thl3  Toze  ana  boob  are  carried  by  a  propeller- 
driven  plane  valued  at  1200, CJO5  then,  a  value  cf  2  x  10-’  .ill 
be  assigned  to  S  for  this  situation. 

8.5  -re  should  next  consider  situation  ci*  (normal  drop  of  the 
ordnance)  which  Includes  the  evonts  that  night  occur  from  the 
tine  of  bcab  release  to  safe  separation.  It  is  estimated  in 
the  absence  of-  information.  ot  this  st-njc  of  the  analysis,  of 
the  nature  of  likely  accidental  initiations  in  this  situation, 
that  one-half  of  the  accidents  which  occur  in  this  situation 
would  occur  before  the  boob  reaches  a  safe  separation  distance. 
Therefore,  a  value  of  1  x  103  is  assigned. 

8.6  The  next  logical  situation  to  consider  would  be  "e" 
(connecting  the  fused  bocb  to  the  plansl.  This  situation  was 
selected  because  it  is  thought  that  an  accident  occurring 
here  could  conceivably  cause  os  each  damage  as  in  any  cf  the 
situations.  Such  an  a: :ident  would  cost  likely  result  in  a 
total  loss  of  the  plane  cn  which  the  bonk  was  being  Installed 
and  damage  of  varying  extent  to  other  pianos  plus  danago  to 
the  carrier  -  the  extent  of  which  would  depend  on  the  size  and, 
location  of  the  bomb  at  that  of  detonation.  A  value  of  4  x  10s 
seeas  reasonable  for  this  situation. 

8.7  The  value  of  S  in  situation  "f  ion  ceck  ref ore  take-off) 
Is  considered  to  be  the  sate  as  for  *e“  because  the  location 
of  the  plane  and  its  surround  lugs  i..  this  situation  would  net 
differ  such  from  those  in  "e". 

8.8  In  situation  "g*  (take-off)  the  potential  hazard  to  the 
carrier  is  reduced  as  the  plane  leaves  the  carrier,  sc  a  value 
between  these  cf  situations  "h”  and  nc“  will  be  selec.sd  -  say 
3  x  10>. 

3.9  Sext  so  will  consider  iii.uui.ion  ra-  (storage,  r.anallng 
end  transportation  outside  of  ordnance).  'his  situation  covers 
the  lie  from  manufacture  of  the  fuze  tu  t  a  -lne  of  its  use. 
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As  a  rule,  loaded  fuzes  are  handled  and  packaged  In  such  a 
carnier  that  they  will  not  counterxi.  a  otfiers  If  one  should 
detonate  inadvertently.  The  coat  of  an  accident  in  this 
situation  ray  vary  considerably.  However,  for  this  analysts 
re  *111  assign  a  value  of  10  tines  the  cost  cf  one  fuse.  Then, 
assuaing  the  cost  of  a  fuze  to  ce  €20,  a  vain-  of  .002  x  107 
*111  be  assigned. 

0.10  Situation  *b*  (fuzing)  where  the  bocb  and  fuze  com  to¬ 
gether,  is  a  situation  of  very  short  duration.  It  begins  »lth 
the  insertion  of  the  fuze  into  the  well  of  the  benb  and  ends 
with  the  closing  of  the  fuze  retainer  cover.  In  this  situation, 
it  is  estimated  that  about  50?  of  the  tine  the  fuze  is  in  such 
a  position  that,  if  the  booster  should  detonate,  the  xatn 
chargeccf  the  beeb  would  also  detonate.  Therefore,  a  value  or 
1  x  107  will  be  assigned  to  this  situation,  in  situation  "c" 
(defusing),  the  conditions  are  considered  to  be  the  sane  as  for 
“b",  so  the  value  of  S  would  be  the  sane.  Should  this  turn  out 
to  be  a  high-hazard  situation,  a  sore  detailed  break-down  eight 
have  to  be  wade. 

8.11  Situation  *d"  (.handling  cf  the  fuzed  bocb)  is  not  a 
corral  practice  In  the  Hav7,  but  it  nay  bo  necessary  under 
certain  conditions.  Ih«  damage  resulting  fren  on  accident 
occurring  in  this  situation  would  be  of  about  tha  seee  magni¬ 
tude  as  in  *b"  or  “c"  for  the  time  the  fuze  is  Installed  In 
the  benb.  Therefore,  since  the  fuze  is  in  the  boot  100£  of 
the  time  In  this  situation,  a  value  of  2  x  107  will  be  assigned 
Values  ror  the  other  situation  were  assigned  by  slsllar 
reasoning  and  ere  given  in  Table  8.1.  It  should  be  noted  that 
in  situations  which  Involve  a  crash  of  the  plane,  as  situ¬ 
ations  1,  c  and  n,  the  cost  of  the  damage  to  the  plane  is  not 
included  in  the  cost  of  the  accident  because  the  plane  daxage 
would  be  practically  the  save  whether  or  not  ordnance  was 
aboard. 


glble  Considerations 


8.12  The  intangible  losses  contained  in  Sj  may  in  some  cases 
be  far  more  important  than  the  tangltle  losses.  In  the  exanple 
analysis  they  have  not  been  avoided  on  the  basis  of  unimpor¬ 
tance,  tut  because  their  proper  evaluation  and  assignoent 
frequently  requires  broader  perspective  then  the  authors  c«n 
dole  tc  possess.  The  crippi'Pg  of  a  carrier  curing  nr  :=r.rr- 
i».it  naval  operation  can  no  more  be  lodged  solely  on  the  t-sls 
of  the  cost  cf  repair  than  can  the  inconvenience  of  the  loss 
of  c  nickel  needs d  for  a  parking  xcter  tc  var-  s  c  five  cents. 
In  either  exeapli  It  is  probable  that  cnly  c  s-iie-t  few  can 
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appreciate  tho  fu-3  is; eel  f  the  accident.  Vt.e  con:  md^r  of 
tr.e  Task  force  seulc  be  it:  *h-  test  pillion  tu  appreciate  a 
aeiicote  balance  of  fewer  5r.  -hi rh  the  slight  loss  of  potential 
caused  cy  the  arrtrfpnt  could  J» o*  *tV  !2*j  the  success  r.f  the 
operation.  Ihat  the  decision  cf  or  not  to  take  a 

chance  of  receiving  a  ticket  because  the  parking  nlerel  was 
lest  «as  influenced  by  the  need  to  buy  «n  ice  crear.  cone 
rather  tl:an  a  long  awaited  dental  aupolnlaent  wcuia  not  be 
known  to  the  casual  passer-by.  7i  at  portion  of  the  severity 
factor  depending  on  the  intangible  looses  is  not  so  easily 
averaged  and  not  so  wisely  appreciatea.  before  conpletlcn  of 
an  Important  analysis,  a  better  appreciation  of  those  intan¬ 
gibles  can  be  obtained  by  talking  to  fleet  personnel. 

8.13  In  spite  of  the  difficulties  Involved  in  arriving  at 
realistic  values  of  the  factor,  the  application  of  good 
cccncn  sense  will  usually  throw  weirnt  to  the  proper  situations. 
Tt  *•***>  ires  no  norc  than  sense::  sens.e  to  seduce  that  an 
accident  destroying  the  decent  of  surprise  in  an  attack  say 
have  tore  serious  consequences  if  it  occurs  early  rather  than 
late  In  the  operation  ev*n  though  the  tangible  lv»»e»  expressed 
in  dollar  cost  of  danage  Inflicted  x*y  be  the  sane.  In  these 
cases,  even  though  the  broad  perspective  required  for  proper 
evaluation  of  these  intangibles  Is  lacking,  the  cosecn  sense 
approach  will  help  to  place  accident  consequences  in  the  proner 
order  and  thus  uld  in  Intelligent  design. 
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TABLE  8.1 
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Situation 


b 

c 

d 


t 

h 

1 

1 
k 
1 

2 
n 


Saverlt.  Factor 
•C02  x  105 
I  z  10** 

1  =  1C5 

2  x  lo‘J 
4  x  1C5 
4  x  105 

3  x  10^ 

2  x  105 

1  x  JO5 

4  x  105 

3  x  135 
3  x  105 
3  x  105 

2  x  10' 
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CHAPILR  9 


RESULTS  AS  A  BASIS  FC.-i  UECISIOltS 

9.1  Completion  of  the  formel  analyr'i,  cnce  the  Individual 
situation  probabilities  have  been  worked  out  as  discussed  In 
Chapter  6  and  the  exposure  aid  severity  factors  selected  as 
noted  in  chapters  7  end  8,  is  merely  a  natter  of  setting  up  a 
table  and  multiplying  and  adding  as  Indicated.  Table  9.1  gives 
the  result  lor  the  iX-200  example . 

9.2  froa  this  point  t",  the  logical  procedure  fer  refining, 
verifying  and  using  the  results  depends  on  the  actual  values 
obtained  In  the  analysis.  Since  this  procedure  win  vary  wit. 
every  Item  studied,  this  chapter  is  wr'tten  In  narrative  for  . 
describing  thought  processes  and  further  mathematical  analyse. 

In  an  order  appropriate  for  this  case  only.  Seme  methods  of 
attack  of  general  usefulness  are  Indicated,  but  In  any  specific 
RAP  study,  one*  all  the  probability  expressions  are  set  up  and 
solved,  the  cost  efficient  course  of  further  action  must  be 
worked  out  for  that  study  individually. 

El-200  Analysis  Study 

9.3  Zba  first  thing  we  consider;  naturally.  Is  the  RAP  Index 
value.  It  works  out  that  the  estimated  accident  cost  (excluding 
Intangibles  in  this  case,  as  noted  in  Chapter  8)  Is  $9'  00  per 
fuze  sannfsetured.  It Js  Is  obviously  unsatisfactory,  if  true. 
Sven  though  this  sight  not  represent  a  major  part  of  the  danage 
expected  to  be  achieved,  per  bomb,  from  use  of  the  fuse  and 
therefore  still  permit  a  favorable  overall  weapon-system  cost 
balance.  It  Is  evident  that  even  doubling  the  cost  of  the  fuze 
(perhaps  (20)  would  be  i  good  buy  if  It  eliminated  most  of  the 
accidents.  The  money  may  as  well  u3  spent  on  fuzes  as  on  air¬ 
craft,  since  all  of  the  Intangibles  will  also  be  on  the  side  of 
safety.  It  Is  therefore  necessary  to  lock  Into  the  causes  of 
this  very  high  value,  to  see  shat  they  a.e  and  what  can  be  done 
about  them. 

Situation  Probability  Comparisons 

9.4  Examining  the  individual  situation  PBS  products  shows  that 
the  bulk  «f  the  hazard  lies  In  two  situations:  ''.normal  crop"  and 
“return  with  hung  ordnance."  Since  the  bomb  is  mad-  one  fuzed 
for  the  end  purpose  of  being  dropped  arsed  rn  a  target,  and 
since  It  is  known  from  experience  thuu  .1.  .-!■  beets  will  hang  up 
that  jettisoning  the  aircraft  In  such  cases  as  S.O.P.  ?•  highly 
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undesirable  C*jven  assuming  that  the  » ilct  could  tell  fcheth*  c  ji 
r.ot  all  LvwL»  h*»u  been  released),  th’e-e  situations  cannot  be 
ellnlnated  by  a  slight  change  ir.  use  doctrine.  The  cause-  of 
these  higr.  M*viiu,y  ill  ties  zust  refers  bo  studied  In  r» t-icr 
detail. 

✓•5  Before  considering  the  two  worst  situations,  it  Is  well  to 
check  the  K*p  Index  fer  the  rest  of  the  situations,  since  this 
is  no  great  effort  and  the  results  nay  Influence  the  course  of 
the  rest  of  the  study.  V7e  find  that  the  sumration  for  all 
situations  except  i  and  k  is  12.5  cents  per  fuze.  Inclusion  of 
Intangible  accident  costs  woulo  raise  this  figure,  tut  on  the 
other  hand,  all  individual  probabilities  uere  selected  or.  the 
high  side  in  case  of  doubt,  so  it  nay  re  expectey  in at  the 
actual  ccst  should  not  be  tmeh,  if  any,  greater  than  this  value 
and  nay  well  be  auch  lower.  Provided  that  the  difficulties  in 
the  two  other  situations  can  be  reduced  to  a  c'cparable  level, 
the  fuze  design  should  be  basically  sound  sarety«:se.  Ine 
actual  12  cents  per  fUze  fis-ure  is  not  accurate  enough  fer  figu¬ 
ring  a  balance  sheet,  tut  indicates  clearly  that  fuze  accidents 
oould  net  be  a  zujor  cost  Jten  in  comparison  wit*  tr.e  other 
costs  of  the  ‘“ccplete  weapon  system. 

Deter:  1  nln.t  the  frocler  Factors 

;.6  ti cw,  returning  to  the  nrocles  children,  we  r.«ed  to  deter¬ 
mine  '-hat  happenstances  are  rescons ible  for  the  big  values  in 
situations  i  and  k.  Since  the  values  of  those  probabilities  in 
other  situations  which  contribute  significantly  to  *he  12  cent 
figure  are  in,  trie  .1  x  10”°  range,  we  should  consider  all  paths 
with  an  end  product  of  10*7  0r  greater.  Checking  with  the  work¬ 
sheet  (Table  6*2)  for  situation  1,  we  find  that  the  following 
paths  contribute  to  this  extant t 
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Since  ir*c  oath  *3  t'n  t izds  {jr^itsr  t nin  p.'.j  »<T- re?  j ati< 

r*:-sol'/e  the  q^  ■* ;  1 9 >  q^  pr"babi  titles  — or??  c  I  e:~  e ly  bo- 
fere  other  paths  sill^ie  of  r*a\ing  in  this  .situation.  It  *  ill 
be  noted  that  the  other  mo st  inccrtant  paths  are  qit..q-. 
*^12.^*  ar,J  «.e  rrobabili*4es  appear  lag  “ndst  fre¬ 

quently  ir.  these  Important  paths  are  q^>  q^i,  to  and  tj.  3ni 
therefore  by  directing  cur  attention  to  tl<ese  *e  can  hope  to 
obtain  the  greatest  InproveKnut.  ihs  Irj  arid  Ip  are 

defined  as  transforms  and  no  practical  gain  *111  be  realized 
from  changing  then,  if  Improvement  is  to  be  gained,  it  rust 
coxe  iron  qx,  q^,  or  q4, 


9.7  L  scheme  for  judging  the  importance  of  individual  factors 
is  given  in  Appendix  0  vnere  the  “relative  sens.*  t  Ivlby"  de¬ 
fined  by  the  equations 


0  Sun  of  path  probabilities 

0  cfo\  —  _2£-  £L*j£  —  of  paths  containing  o. 

^  '  P£  X  See?  all  path  orotab  II  tiles 

*f**Ce)  Is  the  "re  1st  tv.  sensitivity*1  of  an  event  upon  sltuaticn 
".**  where  o<? indicates  a  particular  vaino  of  the  probability  of 
the  event".  In  this  particular  case,  Sqi(l)=0.1,  Sqii(l)=0.se 
and  Sq. (1) = l.C.  Thus  it  is  apparent  that  changing  q-~vili  have 
the  greatest  effect  on  the  probability  of  accident  in  the  situa¬ 
tion,  and  also  that  changing  q^l  *111  have  a  large  effect.  The 
values  for  q^  and  qn.  verc  re-ear.r.ined  in  paragraphs  6.10  and 
6.11  wherw  considerable  justification  a  as  found  for  tlieir  selec¬ 
tion  at  the  values  1  m  10-1  eng  1  x  ^q-2  respectively. 


9.8  It  .ill  h.  noted  that  all  paths  with  probabilities  of  1C*4 
or  worse  involve  firing  of  the  bomb  with  a  shortened,  but  not 
aero,  delay  after  charging  at  the  instant  of  drop.  That  is,  ore 
of  the  two  delays  which  together  sake  up  the  arsing  delay  tine 
is  ineffective  and  hurst  occurs  2  or  seconds  short  of  the 
oofs  separation  <n»t?nce.  this  cep  affect  our  severity  factor, 
and  if  each  delay  were  made  equal  to  a  tine  lo  drop  to  safe 
separation,  presumably  no  aircraft  damage  would  occur  in  any  or 
these  cases.  This  expedient  appears  unn'ccptotlc  c*.  to-  courts, 
however.  Since  separation  velocity  is  proportional  to  the 
square  of  the  elapsed  time,  a  greater  than  proportional  increase 
in  the  minicun  hcmclng  altitude  for  impact  tutor,  sou  Id  result, 
which  would  probably  fc«  tactically  unaccaptahl >•  in  t'i?  f>;rc. 
Secondly,  should  in  troth  one  bomb  in  a  hundred  or  e  thousand 


•  Shis  symbology  ass  the  ccr.ccpt  of  "sorjitivltv"  c** 
probability  to  changes  In  value  of  a  tart lcular* ~enp 
probaMlfy  is  equally  applicable  lo  a.  .  use<2  «-;c 
reliability  analysis.  Present  exaTplec  o:  ruch  use 
on  tajrs  f  higher  classification  but  a  generalizes 
on  the  me  hed  may  be  expected  to  be  available  due 
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burst  la  flight  ni'-ar  an  airclane .  even  though  no  damage  mere 
ao:.e,  the  fuze  wcuIS  Immediately  acquire  a  tad  reputation  and 
its  use  aeulo  very  likely  be  curbed,  officially  or  Informally, 
by  U.o  users  themselves. 

?  Several  useful  ccr.elusicns  nee  folio*  immediately; 

(a)  Every  precaution  must  be  taken  in  the  manufacture  of 
these  particular  components  a ns  their  inspection  must  bo  at  a 
levs!  tc  ‘...sure  maintenance  of  lo*  safety  failure  rates. 

(b)  Since  the  performance  of  explosive  devices  cannot  be 
measured  for  the  ones  actually  used  in  the  ordnance,  but  can 
only  be  deduced  from  the  performance  of  their  brothers  fired  In 
test,  e  great  coal  cf  testing  on  this  particular  design  *111  be 
required  to  establish,  that  a  1c*  fire-through  rat^  hat  in  fact 
been  achieved. 

ic!  Similarly,  It  must  be  demonstrated  by  test  that  the 
envlrcnsent  of  the  felling  boab  does  net  often  produce  switch- 
closing  shocks  cm  emergence  from  Lite  bomb  bay  or  include 
vibration  components  capable  of  causing  switch  closure,  this 
must  be  demonstrated  in  all  aircraft  types,  at  all  usable  speeds 
with  all  applicable  tomb  sizes  and  types.  Since  even  showing 
that  this  lllatllhood  res  less  than  1  In  10  in  all  these  cases  by 
simply  dropping  bombs  with,  switch  closure  indicators  would  take 
hundreds  of  drops,  some  semi-q"vntltat ive  test  program  must  be 
used  -  such  as  measuring  the  environment  or  using  hypersensitive 
swilcr.es  as  indicators. 

9.10  The  products  qj]  q4l  q^tgq,,  and  qyqy^qs  must  Oe  brought 
to  some  value  in  the  1C-3  rang*  to  be  r o-parable  to  the  values 
for  the  fuze  performance  in  all  other  situations.  Diagrammatic- 
ally,  pur  qiiq.  problem  then  looks  like  this,  ii  broken  dews 
-ore  completely: 
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It  Is  doubt ful  i'  switch  nsn-clcsus  can  he  assured  to  -cn  extent 
greater  than  about  1  In  ICO,  because  of  bone-binpl-g  associated 
with  Inadvertent  nls-ccnneni 'on  of  salvoing  c-  intarva_ccnter 
hook-ups  In  the  larger,  nr-'-bcmb  aircraft,  The  natural  fre¬ 
quency  of  the  trembler  switches  ts  In  the  vicinity  cf  ICO  eps, 
which  means  that  they  are  also  probably  subject  to  occasional 
closures  /res  aircraft  vibr’t'en,  whir  .  olankets  this  frequency 
range.  Therefore  the  normal  critical  classification  cf  «  effec¬ 
tive  (closed  or  lew-resistance)  switch  Is  crobably  adequate  to 
control  this  point  In  manufacture* ,  and  U  may  be  assumed  that 
the  possibility  that  an  Initially  food  twitch  becomes  defective 
frea  handling,  shock  ana  vibration  hlsto.-v  can  be  virtually 
eliminated  by  designing  It  to  withstand  severe  evsrslmulatlon: 
of  servlcs  or  aerodynamic  conditions. 

9.11  Bo  natter  what  re  do  about  q4b  and  qSe,  therercre,  qji 
must  be  assured  to  about  1  z  1C~*  or  better.  There  Is  no  regu¬ 
lar  quality  assurance  schedule  of  sanpling  which  will  assure 
this  level  by  brute  force.  Unless  the  doslgn  can  be  made  such 
that  omission  of  the  delay  column  does  not  result  In  a  fire- 
through,  seme  special  design  feacure  which  posit iv-ly  precludes 
assembly  without  the  delay  column  or  else  1G0>  radiographic 
Inspection  must  be  instituted  for  production  quality  control" 
and  the  absence  of  fire-through  likelihood  in  a  properly 
assembled  element  must  be  demonstrated  by  some  quantitative- 
estimate  technique  -  perhaps  tests  at  abnormal  temperatures  cits 
special,  more  powerful  initiators,  and  the  like.  It  till  be 
assumed.  In  order  to  continue  study  of  the  fuze,  that  some  satis¬ 
factory  solution  Is  found  for  the  qjj  q.  problem,  and  the 
related  q,  q^  paths  wb.ch  trgc.tl.er  account  far  over  59. 9>  of  the 
probabilities.  The  cost  of  the  necessary  steps  mentioned  above 
Indicate  that  we  have  here  a  fruitful  place  tc  seel:  some  system 
design  change  to  by-pass  these  problems. 

9.12  Situation  “k-  is  return  and  landing  altfc  a  hung  bomb. 
Kxperience  has  proved  that  this  Is  ’■  situation  which  occurs 
quite  frequently.  The  analysis  nas  indicated  that  ?rr  the 
example  fuze  this  is  a  situation  which  can  be  quite  costly.  From 
Table  9.1  we  ncte  that  the  ostlnaieo  cost  per  fuaa  from 

» Inspection  for  a  critical  defect  (assuming  an  inspection  lot 
greater  than  jf-Ow  gives  assurance  at  the  50*  confidence  .ever 
that  no  iKi-e  than  0,«  of  the  --itches  produced  =111  '-vc  -h.a 

An  9xic»ly  si~llw  pro^lw  exists  in  Jiand  grenades 9  _ 

absence  of  the  delay  ccluaa  virtually  assures  an  accident,  im 
Army  has  found  it  necessary  to  go  to  automatic  x-ray  monitoring 
of  the  presence  cf  the  column  ir.  luoi  o  *  “  production. 
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ic,~Z'  4  **■*■.  “  switch  ncn-clcjur*  can  bo  assured  cc  an  exten. 
*1??  »r  j  4n About  1  in  ICO,  because  of  boafc-lw.Lins  associated 
h  inadvertent  c-s-scnscvticn  salvo lag  cr  interv  .-cceter 
ook-ups  in  the  *arg«»f ,  im^i-bcsb  aircraft.  7ha  natural  rre- 
uency  cf  the  trenbler  switches  is  to  the  vicinity  ©f  ICO  cis, 
h*ch  r^eans  that  they  fit*,  else  ur«.»o*bly  subjoe;  tr  <y»'**«s 
alr"3rt  vlirMion,  which  tla.'tou  O.ii'f 
»ge.  Therefore  the  normal  critical  classification  of  a  derec- 
iva  (closed  or  lce-reslstance)  switch  is  probably  adecuate  to 
t..i;  point  in  manufacture* ,  and  it  zuy  fce  assumed  that 
possibility  that  an  initially  good  switch  bncosas  defective 
*c£  handling,  shock  ecu  vibration  history  can  b*  virtually 
llm  mated  by  designing  It  to  wlinstaaJ  severe  ov^rs* mulattos' 
r  service  or  aerodynamic  conditions* 

'ii  C1'0  "tte;  *hat  M  *>  abort  ait  .Id  <rc,  therefore,  q,, 

Jat  ^  escured  to  ao.«t  1  x  1C or  better.  Th.-re  is  no  rejru- 
ir  quality  assurance  schedule  of  sampling  which  will  assure 
its  lere.  by  brute  force.  Unless  the  design  can  be  «sde  such 
lat  oislssion  or  the  delay  ooJtsa  does  not  result  in  a  fire- 
1T ough,  3M0  special  design  leeure  which  Tioslt-lv-.lv  precludes 
isecbly  without  the  delay  cciutn  or  else  IOCS  radiographic 
»spectioR  su3t  be  instituted  fer  production  our lit-*  centre!** 
id  the  absence  cf  fire-through  likelihood  la  a  properly 
•settled  element  oust  be  ctetaoasl rated  by  scoe  quantitative- 
itimte  technique  -  perhaps  tests  at  abnormal  tccosratures  ^ith 
/eclal,  core  powerful  initiators,  and  the  like.  It  *111  be 
Jsuxed,  in  order  to  continue  study  cf  the  fuze,  tut  sc^  satis- 
ictcry  solution  is  found  f cr  th*  n,,  «  r.-r.vo  — 
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u**cat«  that  we  have  here  a  fruitful  place  to  seek  sos?  system 
•sign  change  to  by-pass  these  problems* 

12  Situation  «k«  is  return  ar.d  low  ling  with  a  hunc  comb, 
perience  ha 2  preveo  that  this  is  a  situation  which  occurs 
itc  frequently,  the  analysis  has  indicated  that  for  the 
aaple  fuze  this  i>  a  situation  which  can  be  quits  costly*  Fra* 
cle  9.1  we  ncte  that  the  est  lrvtt-a  cost  per  fuze  from 


nspeution  for  a  critical  defect  (assuming  an  inspection  lot 
cuter  than  i2GC!  gives  assurance  at  the  conflder.ee  level 
.At  no  rro-K»  than  0»3£  -f  the  switches  produced  *111  here  this 
•fent* 

In  exactly  similar  problem  exists  in  hand  grenades,  where 
--ante  cf  the  delay  column  virtually  assures  an  accident.  Ihe 
sy  ha*  found  it  necessary  to  go  vo  automatic  x-ray  monitoring 
the  presence  cf  the  (chun  ir.  of  the  production. 
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